volute 0.43.1 → 0.45.1

package/dist/daemon.js

@@ -1,4 +1,12 @@
 #!/usr/bin/env node
+import {
+  RESTIC_INSTALL_HINT,
+  initRepo,
+  listSnapshots,
+  readBackupState,
+  resticVersion,
+  runBackup
+} from "./chunk-KVKP6VQ5.js";
 import {
   acceptPending,
   formatFileSize,
@@ -6,21 +14,25 @@ import {
   rejectPending,
   stageFile,
   validateFilePath
-} from "./chunk-2HIVYZDB.js";
+} from "./chunk-UMI4UIJG.js";
 import {
   findOpenClawSession,
   importOpenClawConnectors,
   importPiSession,
   parseNameFromIdentity
-} from "./chunk-JVK6QQIC.js";
+} from "./chunk-LAXUUY7O.js";
 import {
   checkForUpdate,
   checkForUpdateCached,
   getCurrentVersion
-} from "./chunk-AD46AYZQ.js";
+} from "./chunk-2BONPXAF.js";
+import {
+  normalizeAvatar,
+  safeResolveWithinBase
+} from "./chunk-SQL7M4HJ.js";
 import {
   isHomeOnlyArchive
-} from "./chunk-GZJFC76M.js";
+} from "./chunk-QMJJWTNL.js";
 import {
   computeTemplateHash
 } from "./chunk-QMJCNZ6C.js";
@@ -30,7 +42,7 @@ import {
   fixModelEscapes,
   getPlatformDriver,
   routeOutboundBridge
-} from "./chunk-DMUPZQWP.js";
+} from "./chunk-77BVGCTZ.js";
 import {
   getBridgeConfig,
   readBridgesConfig,
@@ -39,7 +51,7 @@ import {
   resolveChannelMapping,
   setBridgeConfig,
   setChannelMapping
-} from "./chunk-57LBQ7JX.js";
+} from "./chunk-FHWUQZXE.js";
 import {
   MindStartupError,
   RestartTracker,
@@ -48,6 +60,7 @@ import {
   announceToSystem,
   authMiddleware,
   checkHealth,
+  checkStaleSend,
   cleanExpiredSessions,
   clearDeliveredNotices,
   createSession,
@@ -56,6 +69,7 @@ import {
   deliverMessage,
   drainNotices,
   ensureSystemChannel,
+  formatHoldNotice,
   formatNotices,
   generateSystemReply,
   getAllDiscoveredExtensions,
@@ -98,15 +112,15 @@ import {
   syncProviderToMinds,
   uninstallNpmExtension,
   writeSystemsConfig
-} from "./chunk-4SVONUTC.js";
+} from "./chunk-U4FNXDEJ.js";
 import {
   loadMergedEnv,
   mindEnvPath,
   readEnv,
   sharedEnvPath,
   writeEnv
-} from "./chunk-XDTKJNW5.js";
-import "./chunk-QQ2MVQU3.js";
+} from "./chunk-5GT7URXJ.js";
+import "./chunk-5AUKCNPE.js";
 import {
   applyInitFiles,
   applyTemplateHomeFiles,
@@ -135,7 +149,7 @@ import {
   syncBuiltinSkills,
   uninstallSkill,
   updateSkill
-} from "./chunk-KINGVQSR.js";
+} from "./chunk-Y6OPHHGM.js";
 import {
   addMessage,
   createChannel,
@@ -167,7 +181,7 @@ import {
   setConversationPrivate,
   subscribe as subscribe2,
   updateChannelSettings
-} from "./chunk-K4EHBHPE.js";
+} from "./chunk-JSRMEY52.js";
 import {
   readVoluteConfig,
   writeVoluteConfig
@@ -175,15 +189,15 @@ import {
 import {
   isSandboxEnabled,
   wrapForSandbox
-} from "./chunk-C6ESRQZ7.js";
+} from "./chunk-OXXTPILE.js";
 import {
   getActiveMinds,
   onMindEvent,
   stopAll
-} from "./chunk-M3PGGSBH.js";
+} from "./chunk-HVU45COX.js";
 import {
   extractTextContent
-} from "./chunk-SPLPKBES.js";
+} from "./chunk-ZIR7HSAX.js";
 import {
   PROMPT_DEFAULTS,
   PROMPT_KEYS,
@@ -192,10 +206,10 @@ import {
   completeTurn,
   createTurn,
   getActiveTurnId,
-  getLastToolUseEventId,
   getMindPromptDefaults,
   getPrompt,
   getPromptIfCustom,
+  getToolUseEventId,
   initSummarizer,
   markErrored,
   publish as publish2,
@@ -206,8 +220,8 @@ import {
   summarizeTurn,
   takeErrored,
   trackToolUse
-} from "./chunk-Y6O35D7K.js";
-import "./chunk-ATEX3ZPG.js";
+} from "./chunk-V4GYPD5L.js";
+import "./chunk-Q2XBKQ2D.js";
 import {
   chownMindDir,
   createMindUser,
@@ -218,7 +232,7 @@ import {
   isIsolationEnabled,
   resolveVoluteBin,
   wrapForIsolation
-} from "./chunk-PGPLCJPK.js";
+} from "./chunk-3ERIL673.js";
 import {
   addCustomModel,
   buildCustomModel,
@@ -239,12 +253,12 @@ import {
   setProviderRefreshHook,
   setUtilityModel,
   unqualifyModelId
-} from "./chunk-YSV3VJQK.js";
+} from "./chunk-TSK5PI4L.js";
 import {
   isSetupComplete,
   readGlobalConfig,
   writeGlobalConfig
-} from "./chunk-ONM2AZFL.js";
+} from "./chunk-322KE457.js";
 import {
   approveUser,
   changePassword,
@@ -263,11 +277,11 @@ import {
   syncMindProfile,
   updateUserProfile,
   verifyUser
-} from "./chunk-EFL5UOY4.js";
+} from "./chunk-CYI534DJ.js";
 import {
   broadcast,
   subscribe
-} from "./chunk-7G2EEYXX.js";
+} from "./chunk-ZMIMSIIT.js";
 import {
   logBuffer,
   logger_default
@@ -299,7 +313,7 @@ import {
   validateMindName,
   voluteHome,
   voluteSystemDir
-} from "./chunk-YAMO2U3N.js";
+} from "./chunk-H7IYFRAL.js";
 import {
   activity,
   channels,
@@ -310,16 +324,80 @@ import {
   systemPrompts,
   turns,
   users
-} from "./chunk-L3IV23ZG.js";
+} from "./chunk-ZV7MFISX.js";
 import "./chunk-K3NQKI34.js";
 
 // packages/daemon/src/daemon.ts
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes as randomBytes3 } from "crypto";
 import { chmodSync, mkdirSync as mkdirSync10, readFileSync as readFileSync10, unlinkSync as unlinkSync2, writeFileSync as writeFileSync9 } from "fs";
 import { homedir as homedir3 } from "os";
-import { resolve as resolve17 } from "path";
+import { resolve as resolve16 } from "path";
 import { format } from "util";
 
+// packages/daemon/src/lib/daemon/backup-manager.ts
+import { CronExpressionParser } from "cron-parser";
+var blog = logger_default.child("backup");
+var DEFAULT_BACKUP_SCHEDULE = "0 3 * * *";
+var BackupManager = class {
+  interval = null;
+  lastFiredMinute = -1;
+  warnedUnconfigured = false;
+  start() {
+    this.interval = setInterval(() => {
+      this.tick().catch((err) => blog.error("backup tick failed", logger_default.errorData(err)));
+    }, 6e4);
+  }
+  stop() {
+    if (this.interval) clearInterval(this.interval);
+    this.interval = null;
+  }
+  /**
+   * True at most once per scheduled fire minute (records the minute it
+   * consumed), and only when backups are enabled and runnable. Not a pure
+   * predicate — a second call in the same minute returns false.
+   */
+  isDue(now = /* @__PURE__ */ new Date()) {
+    const config2 = readGlobalConfig().backup;
+    if (!config2?.enabled) return false;
+    if (!config2.repository || !config2.password) {
+      if (!this.warnedUnconfigured) {
+        blog.warn("scheduled backups are enabled but no repository is initialized \u2014 not running");
+        this.warnedUnconfigured = true;
+      }
+      return false;
+    }
+    this.warnedUnconfigured = false;
+    const cron = config2.schedule || DEFAULT_BACKUP_SCHEDULE;
+    const epochMinute = Math.floor(now.getTime() / 6e4);
+    if (epochMinute === this.lastFiredMinute) return false;
+    let prevMinute;
+    try {
+      const interval = CronExpressionParser.parse(cron, { currentDate: now });
+      prevMinute = Math.floor(interval.prev().toDate().getTime() / 6e4);
+    } catch (err) {
+      blog.warn(`invalid backup cron "${cron}"`, logger_default.errorData(err));
+      return false;
+    }
+    if (prevMinute !== epochMinute) return false;
+    this.lastFiredMinute = epochMinute;
+    return true;
+  }
+  async tick() {
+    if (!this.isDue()) return;
+    blog.info("scheduled backup starting");
+    try {
+      await runBackup();
+    } catch (err) {
+      blog.error("scheduled backup failed", logger_default.errorData(err));
+    }
+  }
+};
+var backupManager = null;
+function initBackupManager() {
+  if (!backupManager) backupManager = new BackupManager();
+  return backupManager;
+}
+
 // packages/daemon/src/lib/daemon/bridge-manager.ts
 import { spawn } from "child_process";
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, unlinkSync, writeFileSync } from "fs";
@@ -388,7 +466,7 @@ function checkMissingBridgeEnv(def, env) {
 }
 
 // packages/daemon/src/lib/daemon/bridge-manager.ts
-var blog = logger_default.child("bridges");
+var blog2 = logger_default.child("bridges");
 function searchUpwards(...segments) {
   let searchDir = dirname(new URL(import.meta.url).pathname);
   for (let i = 0; i < 5; i++) {
@@ -409,7 +487,7 @@ var BridgeManager = class {
     await Promise.all(
       platforms.map(
         (platform) => this.startBridge(platform, daemonPort).catch((err) => {
-          blog.warn(`failed to start bridge ${platform}`, logger_default.errorData(err));
+          blog2.warn(`failed to start bridge ${platform}`, logger_default.errorData(err));
         })
       )
     );
@@ -438,7 +516,7 @@ var BridgeManager = class {
           }
         } catch (err) {
           if (err instanceof Error && err.code !== "ESRCH") {
-            blog.warn(`failed to stop existing bridge ${platform}`, logger_default.errorData(err));
+            blog2.warn(`failed to stop existing bridge ${platform}`, logger_default.errorData(err));
           }
           res();
         }
@@ -503,32 +581,32 @@ var BridgeManager = class {
       }
       if (this.shuttingDown) return;
       if (this.stopping.has(platform)) return;
-      blog.error(`bridge ${platform} exited with code ${code}`);
-      if (lastStderr) blog.warn(`bridge ${platform} last output: ${lastStderr}`);
+      blog2.error(`bridge ${platform} exited with code ${code}`);
+      if (lastStderr) blog2.warn(`bridge ${platform} last output: ${lastStderr}`);
       const { shouldRestart, delay, attempt } = this.restartTracker.recordCrash(platform);
       if (!shouldRestart) {
-        blog.error(`bridge ${platform} crashed ${attempt} times \u2014 giving up`);
+        blog2.error(`bridge ${platform} crashed ${attempt} times \u2014 giving up`);
         return;
       }
-      blog.info(
+      blog2.info(
         `restarting bridge ${platform} \u2014 attempt ${attempt}/${this.restartTracker.maxRestartAttempts}, in ${delay}ms`
       );
       setTimeout(() => {
         if (this.shuttingDown || this.stopping.has(platform)) return;
         this.startBridge(platform, daemonPort).catch((err) => {
-          blog.error(`failed to restart bridge ${platform}`, logger_default.errorData(err));
+          blog2.error(`failed to restart bridge ${platform}`, logger_default.errorData(err));
         });
       }, delay);
     });
-    blog.info(`started bridge ${platform}`);
+    blog2.info(`started bridge ${platform}`);
   }
   async stopBridge(platform) {
     const tracked = this.bridges.get(platform);
     if (!tracked) return;
     this.stopping.add(platform);
     this.bridges.delete(platform);
-    await new Promise((resolve18) => {
-      tracked.child.on("exit", () => resolve18());
+    await new Promise((resolve17) => {
+      tracked.child.on("exit", () => resolve17());
       try {
         if (tracked.child.pid) {
           process.kill(-tracked.child.pid, "SIGTERM");
@@ -537,9 +615,9 @@ var BridgeManager = class {
         }
       } catch (err) {
         if (err instanceof Error && err.code !== "ESRCH") {
-          blog.warn(`failed to stop bridge ${platform}`, logger_default.errorData(err));
+          blog2.warn(`failed to stop bridge ${platform}`, logger_default.errorData(err));
         }
-        resolve18();
+        resolve17();
       }
       setTimeout(() => {
         try {
@@ -550,7 +628,7 @@ var BridgeManager = class {
           }
         } catch {
         }
-        resolve18();
+        resolve17();
       }, 5e3);
     });
     this.stopping.delete(platform);
@@ -558,9 +636,9 @@ var BridgeManager = class {
     try {
       this.removeBridgePid(platform);
     } catch (err) {
-      blog.warn(`failed to remove PID file for bridge ${platform}`, logger_default.errorData(err));
+      blog2.warn(`failed to remove PID file for bridge ${platform}`, logger_default.errorData(err));
     }
-    blog.info(`stopped bridge ${platform}`);
+    blog2.info(`stopped bridge ${platform}`);
   }
   async stopAll() {
     this.shuttingDown = true;
@@ -590,7 +668,7 @@ var BridgeManager = class {
       unlinkSync(this.bridgePidPath(platform));
     } catch (err) {
       if (err instanceof Error && err.code !== "ENOENT") {
-        blog.warn(`failed to remove PID file for bridge ${platform}`, logger_default.errorData(err));
+        blog2.warn(`failed to remove PID file for bridge ${platform}`, logger_default.errorData(err));
       }
     }
   }
@@ -608,18 +686,18 @@ var BridgeManager = class {
           } catch {
           }
         }
-        blog.warn(`killed orphan bridge ${platform} (pid ${pid})`);
+        blog2.warn(`killed orphan bridge ${platform} (pid ${pid})`);
       }
     } catch (err) {
       if (err instanceof Error && err.code !== "ESRCH") {
-        blog.debug(`orphan bridge ${platform} cleanup: ${err}`);
+        blog2.debug(`orphan bridge ${platform} cleanup: ${err}`);
       }
     }
     try {
       unlinkSync(pidPath);
     } catch (err) {
       if (err instanceof Error && err.code !== "ENOENT") {
-        blog.warn(`failed to clean up PID file for orphan bridge ${platform}`, logger_default.errorData(err));
+        blog2.warn(`failed to clean up PID file for orphan bridge ${platform}`, logger_default.errorData(err));
       }
     }
   }
@@ -870,10 +948,10 @@ var app = new Hono().post("/restart", requireAdmin, (c) => {
       stream.writeSSE({ data: JSON.stringify(entry) }).catch(() => {
       });
     });
-    await new Promise((resolve18) => {
+    await new Promise((resolve17) => {
       stream.onAbort(() => {
         unsubscribe();
-        resolve18();
+        resolve17();
       });
     });
   });
@@ -1217,8 +1295,8 @@ var app = new Hono().post("/restart", requireAdmin, (c) => {
       createdAt: Date.now()
     };
     oauthFlows.set(flowId, flow);
-    const promptPromise = needsManualCode ? new Promise((resolve18) => {
-      flow.resolveCode = resolve18;
+    const promptPromise = needsManualCode ? new Promise((resolve17) => {
+      flow.resolveCode = resolve17;
     }) : void 0;
     oauthProvider.login({
       onAuth: (info) => {
@@ -1257,7 +1335,7 @@ var app = new Hono().post("/restart", requireAdmin, (c) => {
         existing.error = err instanceof Error ? err.message : String(err);
       }
     });
-    await new Promise((resolve18) => setTimeout(resolve18, 2e3));
+    await new Promise((resolve17) => setTimeout(resolve17, 2e3));
     const state = oauthFlows.get(flowId);
     return c.json({
       flowId,
@@ -1451,7 +1529,7 @@ function stopApiKeyRefresh() {
 var system_default = app;
 
 // packages/daemon/src/web/app.ts
-import { Hono as Hono28 } from "hono";
+import { Hono as Hono29 } from "hono";
 import { bodyLimit } from "hono/body-limit";
 import { cors } from "hono/cors";
 import { csrf } from "hono/csrf";
@@ -1515,8 +1593,8 @@ var app2 = new Hono2().get("/events", async (c) => {
         });
       }, 15e3);
       cleanups.push(() => clearInterval(keepAlive));
-      await new Promise((resolve18) => {
-        stream.onAbort(() => resolve18());
+      await new Promise((resolve17) => {
+        stream.onAbort(() => resolve17());
       });
     } finally {
       for (const cleanup of cleanups) {
@@ -1531,12 +1609,24 @@ var app2 = new Hono2().get("/events", async (c) => {
 var activity_default = app2;
 
 // packages/daemon/src/web/api/auth.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, rmSync, statSync, writeFileSync as writeFileSync2 } from "fs";
 import { extname, resolve as resolve3 } from "path";
 import { zValidator as zValidator2 } from "@hono/zod-validator";
 import { Hono as Hono3 } from "hono";
 import { deleteCookie, getCookie, setCookie } from "hono/cookie";
 import { z as z2 } from "zod";
+
+// packages/daemon/src/lib/util/http-cache.ts
+function fileEtag(stat3) {
+  return `W/"${stat3.mtimeMs.toString(36)}-${stat3.size.toString(36)}"`;
+}
+function isNotModified(c, etag) {
+  const inm = c.req.header("if-none-match");
+  if (!inm) return false;
+  return inm.split(",").some((t) => t.trim() === etag);
+}
+
+// packages/daemon/src/web/api/auth.ts
 function tryJoinSystem(userId) {
   if (!process.env.VOLUTE_DAEMON_TOKEN) return;
   joinSystemChannel(userId).catch(() => {
@@ -1603,10 +1693,16 @@ var authenticated = new Hono3().use(authMiddleware).post("/change-password", zVa
   if (!AVATAR_MIME[ext]) {
     return c.json({ error: "Invalid file type (png, jpg, gif, webp only)" }, 400);
   }
+  let buffer2 = Buffer.from(await file.arrayBuffer());
+  let finalExt = ext;
+  const normalized = await normalizeAvatar(buffer2);
+  if (normalized) {
+    buffer2 = normalized.buffer;
+    finalExt = normalized.ext;
+  }
   const dir = avatarsDir();
   mkdirSync2(dir, { recursive: true });
-  const filename = `avatar-${user.id}${ext}`;
-  const buffer2 = Buffer.from(await file.arrayBuffer());
+  const filename = `avatar-${user.id}${finalExt}`;
   writeFileSync2(resolve3(dir, filename), buffer2);
   if (user.avatar && user.avatar !== filename) {
     const oldPath = resolve3(dir, user.avatar);
@@ -1786,19 +1882,129 @@ var app3 = new Hono3().post("/register", zValidator2("json", credentialsSchema),
   const ext = extname(filename).toLowerCase();
   const mime = AVATAR_MIME[ext];
   if (!mime) return c.json({ error: "Invalid file type" }, 400);
-  const data = readFileSync3(filePath);
-  return c.body(data, 200, {
+  const fileStat = statSync(filePath);
+  const etag = fileEtag(fileStat);
+  const headers = {
     "Content-Type": mime,
     "Cache-Control": "public, max-age=3600",
-    "X-Content-Type-Options": "nosniff"
-  });
+    "X-Content-Type-Options": "nosniff",
+    ETag: etag
+  };
+  if (isNotModified(c, etag)) return c.body(null, 304, headers);
+  const data = readFileSync3(filePath);
+  return c.body(data, 200, headers);
 }).route("/", admin).route("/", authenticated);
 var auth_default = app3;
 
-// packages/daemon/src/web/api/bridges.ts
+// packages/daemon/src/web/api/backup.ts
+import { randomBytes } from "crypto";
 import { zValidator as zValidator3 } from "@hono/zod-validator";
+import { CronExpressionParser as CronExpressionParser2 } from "cron-parser";
 import { Hono as Hono4 } from "hono";
 import { z as z3 } from "zod";
+function redactedConfig() {
+  const backup2 = readGlobalConfig().backup ?? {};
+  return {
+    repository: backup2.repository,
+    schedule: backup2.schedule ?? DEFAULT_BACKUP_SCHEDULE,
+    enabled: backup2.enabled,
+    keep: backup2.keep,
+    includeSessions: backup2.includeSessions,
+    hasPassword: !!backup2.password,
+    envKeys: Object.keys(backup2.env ?? {})
+  };
+}
+var configSchema = z3.object({
+  repository: z3.string().optional(),
+  schedule: z3.string().refine(
+    (cron) => {
+      try {
+        CronExpressionParser2.parse(cron);
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    { message: "Invalid cron expression" }
+  ).optional(),
+  enabled: z3.boolean().optional(),
+  keep: z3.object({
+    daily: z3.number().int().min(0).optional(),
+    weekly: z3.number().int().min(0).optional(),
+    monthly: z3.number().int().min(0).optional()
+  }).refine((keep) => !(keep.daily === 0 && keep.weekly === 0 && keep.monthly === 0), {
+    message: "Retention cannot be zero everywhere \u2014 prune would delete every snapshot"
+  }).optional(),
+  includeSessions: z3.boolean().optional(),
+  password: z3.string().optional(),
+  env: z3.record(z3.string(), z3.string()).optional()
+});
+var backup = new Hono4().get("/config", requireAdmin, (c) => c.json(redactedConfig())).put("/config", requireAdmin, zValidator3("json", configSchema), (c) => {
+  const updates = c.req.valid("json");
+  const config2 = readGlobalConfig();
+  const current = config2.backup ?? {};
+  config2.backup = {
+    ...current,
+    ...updates,
+    // Empty-string password means "keep existing" so the UI can save
+    // settings without re-entering the passphrase.
+    password: updates.password || current.password,
+    env: updates.env ?? current.env
+  };
+  writeGlobalConfig(config2);
+  return c.json(redactedConfig());
+}).post("/init", requireAdmin, async (c) => {
+  const config2 = readGlobalConfig();
+  if (!config2.backup?.repository) {
+    return c.json({ error: "Backup repository is not configured" }, 400);
+  }
+  let generatedPassword = null;
+  if (!config2.backup.password) {
+    generatedPassword = randomBytes(32).toString("base64url");
+    config2.backup.password = generatedPassword;
+  }
+  try {
+    await initRepo(config2.backup);
+  } catch (err) {
+    const stderr = err.stderr;
+    const detail = err instanceof Error ? err.message : String(err);
+    return c.json({ error: stderr?.trim() || detail }, 500);
+  }
+  if (generatedPassword) writeGlobalConfig(config2);
+  return c.json({ ok: true, password: generatedPassword });
+}).post("/run", requireAdmin, async (c) => {
+  try {
+    const summary = await runBackup();
+    return c.json(summary);
+  } catch (err) {
+    const stderr = err.stderr;
+    const detail = err instanceof Error ? err.message : String(err);
+    return c.json({ error: stderr?.trim() || detail }, 500);
+  }
+}).get("/snapshots", requireAdmin, async (c) => {
+  try {
+    return c.json(await listSnapshots());
+  } catch (err) {
+    const stderr = err.stderr;
+    const detail = err instanceof Error ? err.message : String(err);
+    return c.json({ error: stderr?.trim() || detail }, 500);
+  }
+}).get("/status", requireAdmin, async (c) => {
+  const version = await resticVersion();
+  return c.json({
+    resticInstalled: version !== null,
+    resticVersion: version,
+    installHint: version === null ? RESTIC_INSTALL_HINT : null,
+    config: redactedConfig(),
+    state: readBackupState()
+  });
+});
+var backup_default = backup;
+
+// packages/daemon/src/web/api/bridges.ts
+import { zValidator as zValidator4 } from "@hono/zod-validator";
+import { Hono as Hono5 } from "hono";
+import { z as z4 } from "zod";
 
 // packages/daemon/src/lib/chat/puppets.ts
 import { and as and2, eq as eq2 } from "drizzle-orm";
@@ -1847,17 +2053,6 @@ async function findOrCreatePuppet(platform, platformId, displayName) {
 }
 
 // packages/daemon/src/lib/delivery/fan-out.ts
-var MAX_CONSECUTIVE_MIND_TURNS = 6;
-var consecutiveMindTurns = /* @__PURE__ */ new Map();
-async function emitLoopNotice(conversationId) {
-  const systemUser = await getOrCreateSystemUser();
-  await addMessage(conversationId, "user", systemUser.username, [
-    {
-      type: "text",
-      text: `[System] This exchange has continued for ${MAX_CONSECUTIVE_MIND_TURNS} consecutive automated turns without human input, so automatic delivery between minds has been paused. Send a message to resume.`
-    }
-  ]);
-}
 async function fanOutToMinds(opts) {
   const participants = opts.participants ?? await getParticipants(opts.conversationId);
   const mindParticipants = participants.filter(
@@ -1865,25 +2060,6 @@ async function fanOutToMinds(opts) {
   );
   const participantNames = participants.map((p) => p.username);
   const isDM = opts.isDM ?? participants.length === 2;
-  if (mindParticipants.length > 1) {
-    if (opts.senderIsMind) {
-      const count = (consecutiveMindTurns.get(opts.conversationId) ?? 0) + 1;
-      consecutiveMindTurns.set(opts.conversationId, count);
-      if (count > MAX_CONSECUTIVE_MIND_TURNS) {
-        if (count === MAX_CONSECUTIVE_MIND_TURNS + 1) {
-          await emitLoopNotice(opts.conversationId).catch(
-            (err) => logger_default.warn(`failed to emit loop notice for ${opts.conversationId}`, logger_default.errorData(err))
-          );
-        }
-        logger_default.warn(
-          `loop protection: paused mind fan-out for ${opts.conversationId} after ${count} consecutive mind turns`
-        );
-        return;
-      }
-    } else {
-      consecutiveMindTurns.delete(opts.conversationId);
-    }
-  }
   const manager = getMindManager();
   const sm = getSleepManagerIfReady();
   const targetMinds = mindParticipants.map((ap) => {
@@ -1917,27 +2093,27 @@ async function fanOutToMinds(opts) {
 }
 
 // packages/daemon/src/web/api/bridges.ts
-var inboundSchema = z3.object({
-  content: z3.array(
-    z3.union([
-      z3.object({ type: z3.literal("text"), text: z3.string() }),
-      z3.object({ type: z3.literal("image"), media_type: z3.string(), data: z3.string() })
+var inboundSchema = z4.object({
+  content: z4.array(
+    z4.union([
+      z4.object({ type: z4.literal("text"), text: z4.string() }),
+      z4.object({ type: z4.literal("image"), media_type: z4.string(), data: z4.string() })
     ])
   ).min(1),
-  platformUserId: z3.string(),
-  displayName: z3.string(),
-  externalChannel: z3.string(),
-  isDM: z3.boolean(),
-  targetMind: z3.string().optional()
+  platformUserId: z4.string(),
+  displayName: z4.string(),
+  externalChannel: z4.string(),
+  isDM: z4.boolean(),
+  targetMind: z4.string().optional()
 });
-var mappingSchema = z3.object({
-  externalChannel: z3.string(),
-  voluteChannel: z3.string()
+var mappingSchema = z4.object({
+  externalChannel: z4.string(),
+  voluteChannel: z4.string()
 });
-var enableSchema = z3.object({
-  defaultMind: z3.string()
+var enableSchema = z4.object({
+  defaultMind: z4.string()
 });
-var app4 = new Hono4().post("/:platform/inbound", zValidator3("json", inboundSchema), async (c) => {
+var app4 = new Hono5().post("/:platform/inbound", zValidator4("json", inboundSchema), async (c) => {
   const user = c.get("user");
   if (user.id !== 0) return c.json({ error: "Bridge inbound requires daemon token" }, 403);
   const platform = c.req.param("platform");
@@ -1989,7 +2165,7 @@ var app4 = new Hono4().post("/:platform/inbound", zValidator3("json", inboundSch
   }
   const participants = await getParticipants(channel.id);
   if (!participants.some((p) => p.userId === puppet.id)) {
-    const { addParticipant } = await import("./conversations-67WWW25C.js");
+    const { addParticipant } = await import("./conversations-G4LYMHAA.js");
     await addParticipant(channel.id, puppet.id);
   }
   const contentBlocks = body.content;
@@ -2019,7 +2195,7 @@ var app4 = new Hono4().post("/:platform/inbound", zValidator3("json", inboundSch
     };
   });
   return c.json(bridges);
-}).post("/:platform", requireAdmin, zValidator3("json", enableSchema), async (c) => {
+}).post("/:platform", requireAdmin, zValidator4("json", enableSchema), async (c) => {
   const platform = c.req.param("platform");
   const body = c.req.valid("json");
   const def = getBridgeDef(platform);
@@ -2058,7 +2234,7 @@ var app4 = new Hono4().post("/:platform/inbound", zValidator3("json", inboundSch
   await manager.stopBridge(platform);
   removeBridgeConfig(platform);
   return c.json({ ok: true });
-}).put("/:platform/mappings", requireAdmin, zValidator3("json", mappingSchema), (c) => {
+}).put("/:platform/mappings", requireAdmin, zValidator4("json", mappingSchema), (c) => {
   const platform = c.req.param("platform");
   const body = c.req.valid("json");
   try {
@@ -2083,18 +2259,17 @@ async function fanOutToBridgedMinds(opts) {
     conversationId: opts.conversationId,
     contentBlocks: opts.contentBlocks,
     senderName: opts.senderName,
-    senderIsMind: false,
     isDM: opts.isDM
   });
 }
 var bridges_default = app4;
 
 // packages/daemon/src/web/api/channels.ts
-import { Hono as Hono5 } from "hono";
+import { Hono as Hono6 } from "hono";
 function buildEnv(name) {
   return { ...loadMergedEnv(name), VOLUTE_MIND: name, VOLUTE_MIND_DIR: mindDir(name) };
 }
-var app5 = new Hono5().post("/:name/channels/create", requireSelf(), async (c) => {
+var app5 = new Hono6().post("/:name/channels/create", requireSelf(), async (c) => {
   const name = c.req.param("name");
   if (!await findMind(name)) return c.json({ error: "Mind not found" }, 404);
   const {
@@ -2119,8 +2294,8 @@ var app5 = new Hono5().post("/:name/channels/create", requireSelf(), async (c) =
 var channels_default = app5;
 
 // packages/daemon/src/web/api/config.ts
-import { Hono as Hono6 } from "hono";
-var config = new Hono6();
+import { Hono as Hono7 } from "hono";
+var config = new Hono7();
 config.get("/models", async (c) => {
   const enabled = new Set(getEnabledModels());
   const all = await getAvailableModels();
@@ -2147,8 +2322,8 @@ config.get("/status", (c) => {
 var config_default = config;
 
 // packages/daemon/src/web/api/env.ts
-import { Hono as Hono7 } from "hono";
-var app6 = new Hono7().get("/:name/env", requireSelf(), async (c) => {
+import { Hono as Hono8 } from "hono";
+var app6 = new Hono8().get("/:name/env", requireSelf(), async (c) => {
   const name = c.req.param("name");
   if (!await findMind(name)) return c.json({ error: "Mind not found" }, 404);
   const shared = readEnv(sharedEnvPath());
@@ -2191,7 +2366,7 @@ var app6 = new Hono7().get("/:name/env", requireSelf(), async (c) => {
   writeEnv(path, env);
   return c.json({ ok: true });
 });
-var sharedEnvApp = new Hono7().get("/", requireAdmin, (c) => {
+var sharedEnvApp = new Hono8().get("/", requireAdmin, (c) => {
   return c.json(readEnv(sharedEnvPath()));
 }).put("/:key", requireAdmin, async (c) => {
   const key = c.req.param("key");
@@ -2221,8 +2396,8 @@ var sharedEnvApp = new Hono7().get("/", requireAdmin, (c) => {
 var env_default = app6;
 
 // packages/daemon/src/web/api/extensions.ts
-import { Hono as Hono8 } from "hono";
-var app7 = new Hono8().get("/", (c) => {
+import { Hono as Hono9 } from "hono";
+var app7 = new Hono9().get("/", (c) => {
   return c.json(getLoadedExtensions());
 }).get("/all", (c) => {
   const detail = c.req.query("detail") === "true";
@@ -2267,20 +2442,20 @@ var app7 = new Hono8().get("/", (c) => {
 var extensions_default = app7;
 
 // packages/daemon/src/web/api/file-sharing.ts
-import { readFileSync as readFileSync4, statSync } from "fs";
+import { readFileSync as readFileSync4, statSync as statSync2 } from "fs";
 import { resolve as resolve4 } from "path";
-import { Hono as Hono9 } from "hono";
+import { Hono as Hono10 } from "hono";
 async function notifyMind(mindName, message) {
   const entry = await findMind(mindName);
   if (!entry) return;
   try {
-    const { sendSystemMessage } = await import("./system-chat-54RN3K67.js");
+    const { sendSystemMessage } = await import("./system-chat-E65T2HSW.js");
     await sendSystemMessage(mindName, message);
   } catch (err) {
     logger_default.warn(`[file-sharing] notify mind ${mindName} failed`, logger_default.errorData(err));
   }
 }
-var app8 = new Hono9().post("/:name/files/send", requireSelf(), async (c) => {
+var app8 = new Hono10().post("/:name/files/send", requireSelf(), async (c) => {
   const senderName = c.req.param("name");
   const senderEntry = await findMind(senderName);
   if (!senderEntry) return c.json({ error: "Sender mind not found" }, 404);
@@ -2295,7 +2470,7 @@ var app8 = new Hono9().post("/:name/files/send", requireSelf(), async (c) => {
   const senderDir = mindDir(senderName);
   const filePath = resolve4(senderDir, "home", body.filePath);
   const MAX_FILE_SIZE3 = 50 * 1024 * 1024;
-  const stat3 = statSync(filePath, { throwIfNoEntry: false });
+  const stat3 = statSync2(filePath, { throwIfNoEntry: false });
   if (!stat3) return c.json({ error: `File not found: ${body.filePath}` }, 404);
   if (stat3.size > MAX_FILE_SIZE3) {
     return c.json(
@@ -2399,34 +2574,8 @@ var file_sharing_default = app8;
 // packages/daemon/src/web/api/files.ts
 import { mkdirSync as mkdirSync3, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import { readdir, readFile, realpath, stat } from "fs/promises";
-import { extname as extname2, resolve as resolve6 } from "path";
-import { Hono as Hono10 } from "hono";
-
-// packages/daemon/src/lib/util/paths.ts
-import { resolve as resolve5, sep } from "path";
-var PathTraversalError = class extends Error {
-  constructor(base, userPath) {
-    super(`Path "${userPath}" escapes base directory "${base}"`);
-    this.name = "PathTraversalError";
-  }
-};
-function resolveWithinBase(base, userPath) {
-  const resolvedBase = resolve5(base);
-  const target = resolve5(resolvedBase, userPath);
-  if (target !== resolvedBase && !target.startsWith(resolvedBase + sep)) {
-    throw new PathTraversalError(base, userPath);
-  }
-  return target;
-}
-function safeResolveWithinBase(base, userPath) {
-  try {
-    return resolveWithinBase(base, userPath);
-  } catch {
-    return null;
-  }
-}
-
-// packages/daemon/src/web/api/files.ts
+import { extname as extname2, resolve as resolve5 } from "path";
+import { Hono as Hono11 } from "hono";
 var AVATAR_MIME2 = {
   ".png": "image/png",
   ".jpg": "image/jpeg",
@@ -2453,7 +2602,7 @@ var MIME_TYPES = {
   ".woff": "font/woff",
   ".woff2": "font/woff2"
 };
-var app9 = new Hono10().post("/:name/avatar", requireSelf(), async (c) => {
+var app9 = new Hono11().post("/:name/avatar", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
@@ -2469,17 +2618,23 @@ var app9 = new Hono10().post("/:name/avatar", requireSelf(), async (c) => {
   if (!AVATAR_MIME2[ext]) {
     return c.json({ error: "Invalid file type (png, jpg, gif, webp only)" }, 400);
   }
+  let buffer2 = Buffer.from(await file.arrayBuffer());
+  let finalExt = ext;
+  const normalized = await normalizeAvatar(buffer2);
+  if (normalized) {
+    buffer2 = normalized.buffer;
+    finalExt = normalized.ext;
+  }
   const dir = entry.dir ?? mindDir(name);
-  const homeDir = resolve6(dir, "home");
-  const filename = `avatar${ext}`;
-  const avatarPath = resolve6(homeDir, filename);
+  const homeDir = resolve5(dir, "home");
+  const filename = `avatar${finalExt}`;
+  const avatarPath = resolve5(homeDir, filename);
   const config2 = readVoluteConfig(dir) ?? {};
   const oldAvatar = config2.profile?.avatar;
   if (oldAvatar && oldAvatar !== filename) {
     const oldAvatarPath = safeResolveWithinBase(homeDir, oldAvatar);
     if (oldAvatarPath) rmSync2(oldAvatarPath, { force: true });
   }
-  const buffer2 = Buffer.from(await file.arrayBuffer());
   mkdirSync3(homeDir, { recursive: true });
   writeFileSync3(avatarPath, buffer2);
   const profile = config2.profile ?? {};
@@ -2499,8 +2654,8 @@ var app9 = new Hono10().post("/:name/avatar", requireSelf(), async (c) => {
   const ext = extname2(config2.profile.avatar).toLowerCase();
   const mime = AVATAR_MIME2[ext];
   if (!mime) return c.json({ error: "Invalid avatar extension" }, 400);
-  const homeDir = resolve6(dir, "home");
-  const avatarPath = resolve6(homeDir, config2.profile.avatar);
+  const homeDir = resolve5(dir, "home");
+  const avatarPath = resolve5(homeDir, config2.profile.avatar);
   if (!avatarPath.startsWith(`${homeDir}/`)) return c.json({ error: "Invalid avatar path" }, 400);
   let realAvatarPath;
   try {
@@ -2516,11 +2671,15 @@ var app9 = new Hono10().post("/:name/avatar", requireSelf(), async (c) => {
   try {
     const fileStat = await stat(realAvatarPath);
     if (fileStat.size > MAX_AVATAR_SIZE2) return c.json({ error: "Avatar file too large" }, 400);
-    const body = await readFile(realAvatarPath);
-    return c.body(body, 200, {
+    const etag = fileEtag(fileStat);
+    const headers = {
       "Content-Type": mime,
-      "Cache-Control": "public, max-age=300"
-    });
+      "Cache-Control": "public, max-age=300",
+      ETag: etag
+    };
+    if (isNotModified(c, etag)) return c.body(null, 304, headers);
+    const body = await readFile(realAvatarPath);
+    return c.body(body, 200, headers);
   } catch {
     return c.json({ error: "Failed to read avatar file" }, 500);
   }
@@ -2528,7 +2687,7 @@ var app9 = new Hono10().post("/:name/avatar", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const homeDir = resolve6(entry.dir ?? mindDir(name), "home");
+  const homeDir = resolve5(entry.dir ?? mindDir(name), "home");
   let entries;
   try {
     entries = await readdir(homeDir, { withFileTypes: true });
@@ -2543,10 +2702,10 @@ var app9 = new Hono10().post("/:name/avatar", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const homeDir = resolve6(entry.dir ?? mindDir(name), "home");
+  const homeDir = resolve5(entry.dir ?? mindDir(name), "home");
   const wildcard = c.req.path.replace(new RegExp(`^.*/minds/${name}/files`), "") || "/";
   const relativePath = wildcard.slice(1);
-  const requestedPath = resolve6(homeDir, relativePath);
+  const requestedPath = resolve5(homeDir, relativePath);
   if (requestedPath !== homeDir && !requestedPath.startsWith(`${homeDir}/`))
     return c.text("Forbidden", 403);
   if (relativePath.split("/").some((seg) => seg.startsWith("."))) return c.text("Forbidden", 403);
@@ -2577,15 +2736,18 @@ var app9 = new Hono10().post("/:name/avatar", requireSelf(), async (c) => {
     return c.json(items);
   }
   if (fileStat.size > MAX_FILE_SIZE) return c.text("File too large", 413);
-  const body = await readFile(resolvedPath);
   const mime = MIME_TYPES[extname2(resolvedPath).toLowerCase()] || "application/octet-stream";
-  return c.body(body, 200, { "Content-Type": mime });
+  const etag = fileEtag(fileStat);
+  const headers = { "Content-Type": mime, "Cache-Control": "no-cache", ETag: etag };
+  if (isNotModified(c, etag)) return c.body(null, 304, headers);
+  const body = await readFile(resolvedPath);
+  return c.body(body, 200, headers);
 });
 var files_default = app9;
 
 // packages/daemon/src/web/api/history.ts
 import { and as and3, desc as desc2, eq as eq3, gte, inArray, sql } from "drizzle-orm";
-import { Hono as Hono11 } from "hono";
+import { Hono as Hono12 } from "hono";
 async function resolveMindFilter(c) {
   const user = c.get("user");
   if (user.role === "admin" || user.role === "system") {
@@ -2593,7 +2755,7 @@ async function resolveMindFilter(c) {
   }
   return getBaseName(user.username);
 }
-var history = new Hono11().get("/turns", async (c) => {
+var history = new Hono12().get("/turns", async (c) => {
   const mindFilter = await resolveMindFilter(c);
   const turnIdFilter = c.req.query("turnId");
   const turnIdsFilter = c.req.query("turnIds");
@@ -2984,21 +3146,21 @@ var history = new Hono11().get("/turns", async (c) => {
 var history_default = history;
 
 // packages/daemon/src/web/api/keys.ts
-import { Hono as Hono12 } from "hono";
+import { Hono as Hono13 } from "hono";
 
 // packages/daemon/src/lib/mind/identity.ts
 import { createHash, generateKeyPairSync, sign, verify } from "crypto";
 import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
-import { resolve as resolve7 } from "path";
+import { resolve as resolve6 } from "path";
 function generateIdentity(mindDir2) {
-  const identityDir = resolve7(mindDir2, ".mind/identity");
+  const identityDir = resolve6(mindDir2, ".mind/identity");
   mkdirSync4(identityDir, { recursive: true });
   const { publicKey, privateKey } = generateKeyPairSync("ed25519", {
     publicKeyEncoding: { type: "spki", format: "pem" },
     privateKeyEncoding: { type: "pkcs8", format: "pem" }
   });
-  const privatePath = resolve7(identityDir, "private.pem");
-  const publicPath = resolve7(identityDir, "public.pem");
+  const privatePath = resolve6(identityDir, "private.pem");
+  const publicPath = resolve6(identityDir, "public.pem");
   writeFileSync4(privatePath, privateKey, { mode: 384 });
   writeFileSync4(publicPath, publicKey, { mode: 420 });
   const config2 = readVoluteConfig(mindDir2) ?? {};
@@ -3013,7 +3175,7 @@ function getPublicKey(mindDir2) {
   const config2 = readVoluteConfig(mindDir2);
   const relPath = config2?.identity?.publicKey;
   if (!relPath) return null;
-  const fullPath = resolve7(mindDir2, relPath);
+  const fullPath = resolve6(mindDir2, relPath);
   if (!existsSync4(fullPath)) return null;
   return readFileSync5(fullPath, "utf-8");
 }
@@ -3044,7 +3206,7 @@ async function publishPublicKey(mindName, publicKeyPem) {
 }
 
 // packages/daemon/src/web/api/keys.ts
-var app10 = new Hono12().get("/:fingerprint", async (c) => {
+var app10 = new Hono13().get("/:fingerprint", async (c) => {
   const fingerprint = c.req.param("fingerprint");
   for (const entry of await readRegistry()) {
     try {
@@ -3063,14 +3225,14 @@ var keys_default = app10;
 // packages/daemon/src/web/api/logs.ts
 import { spawn as spawn2 } from "child_process";
 import { existsSync as existsSync5 } from "fs";
-import { resolve as resolve8 } from "path";
-import { Hono as Hono13 } from "hono";
+import { resolve as resolve7 } from "path";
+import { Hono as Hono14 } from "hono";
 import { streamSSE as streamSSE3 } from "hono/streaming";
-var app11 = new Hono13().get("/:name/logs", requireSelf(), async (c) => {
+var app11 = new Hono14().get("/:name/logs", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const logFile = resolve8(stateDir(name), "logs", "mind.log");
+  const logFile = resolve7(stateDir(name), "logs", "mind.log");
   if (!existsSync5(logFile)) {
     return c.json({ error: "No log file found" }, 404);
   }
@@ -3089,16 +3251,16 @@ var app11 = new Hono13().get("/:name/logs", requireSelf(), async (c) => {
     stream.onAbort(() => {
       tail.kill();
     });
-    await new Promise((resolve18) => {
-      tail.on("exit", resolve18);
-      stream.onAbort(resolve18);
+    await new Promise((resolve17) => {
+      tail.on("exit", resolve17);
+      stream.onAbort(resolve17);
     });
   });
 }).get("/:name/logs/tail", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const logFile = resolve8(stateDir(name), "logs", "mind.log");
+  const logFile = resolve7(stateDir(name), "logs", "mind.log");
   if (!existsSync5(logFile)) {
     return c.json({ error: "No log file found" }, 404);
   }
@@ -3109,18 +3271,18 @@ var app11 = new Hono13().get("/:name/logs", requireSelf(), async (c) => {
   tail.stdout.on("data", (data) => {
     output += data.toString();
   });
-  await new Promise((resolve18) => {
-    tail.on("exit", resolve18);
+  await new Promise((resolve17) => {
+    tail.on("exit", resolve17);
   });
   return c.text(output);
 });
 var logs_default = app11;
 
 // packages/daemon/src/web/api/mind-skills.ts
-import { zValidator as zValidator4 } from "@hono/zod-validator";
-import { Hono as Hono14 } from "hono";
-import { z as z4 } from "zod";
-var app12 = new Hono14().get("/:name/skills", async (c) => {
+import { zValidator as zValidator5 } from "@hono/zod-validator";
+import { Hono as Hono15 } from "hono";
+import { z as z5 } from "zod";
+var app12 = new Hono15().get("/:name/skills", async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
@@ -3130,7 +3292,7 @@ var app12 = new Hono14().get("/:name/skills", async (c) => {
 }).post(
   "/:name/skills/install",
   requireSelf(),
-  zValidator4("json", z4.object({ skillId: z4.string() })),
+  zValidator5("json", z5.object({ skillId: z5.string() })),
   async (c) => {
     const name = c.req.param("name");
     const entry = await findMind(name);
@@ -3148,7 +3310,7 @@ var app12 = new Hono14().get("/:name/skills", async (c) => {
 ).post(
   "/:name/skills/update",
   requireSelf(),
-  zValidator4("json", z4.object({ skillId: z4.string() })),
+  zValidator5("json", z5.object({ skillId: z5.string() })),
   async (c) => {
     const name = c.req.param("name");
     const entry = await findMind(name);
@@ -3166,7 +3328,7 @@ var app12 = new Hono14().get("/:name/skills", async (c) => {
 ).post(
   "/:name/skills/publish",
   requireSelf(),
-  zValidator4("json", z4.object({ skillId: z4.string() })),
+  zValidator5("json", z5.object({ skillId: z5.string() })),
   async (c) => {
     const name = c.req.param("name");
     const entry = await findMind(name);
@@ -3207,11 +3369,11 @@ import {
   rmSync as rmSync4,
   writeFileSync as writeFileSync7
 } from "fs";
-import { basename, resolve as resolve11 } from "path";
-import { zValidator as zValidator5 } from "@hono/zod-validator";
+import { relative, resolve as resolve10 } from "path";
+import { zValidator as zValidator6 } from "@hono/zod-validator";
 import { and as and5, desc as desc4, eq as eq5, sql as sql3 } from "drizzle-orm";
-import { Hono as Hono15 } from "hono";
-import { z as z5 } from "zod";
+import { Hono as Hono16 } from "hono";
+import { z as z6 } from "zod";
 
 // packages/daemon/src/lib/daemon/turn-lifecycle.ts
 import { and as and4, desc as desc3, eq as eq4, inArray as inArray2, sql as sql2 } from "drizzle-orm";
@@ -3328,13 +3490,18 @@ async function handleMindEvent(mind, event) {
     }).returning({ id: mindHistory.id });
     insertedId = result[0]?.id;
   } catch (err) {
-    llog.error(`failed to persist event for ${mind}`, logger_default.errorData(err));
+    llog.error(
+      `HISTORY GAP: failed to persist ${event.type} event for ${mind}${event.session ? ` (session ${event.session})` : ""}${event.channel ? ` on ${event.channel}` : ""}`,
+      logger_default.errorData(err)
+    );
   }
   if (event.type === "tool_use" && insertedId != null) {
-    trackToolUse(mind, event.session, insertedId);
+    const toolUseId = typeof event.metadata?.id === "string" ? event.metadata.id : void 0;
+    trackToolUse(mind, event.session, insertedId, toolUseId);
   }
   if (event.type === "tool_result" && turnId && event.content) {
-    const toolUseEventId = getLastToolUseEventId(mind, event.session);
+    const resultToolUseId = typeof event.metadata?.tool_use_id === "string" ? event.metadata.tool_use_id : void 0;
+    const toolUseEventId = getToolUseEventId(mind, event.session, resultToolUseId);
     try {
       await linkToolResultToTurn(mind, turnId, event.content, toolUseEventId);
     } catch (err) {
@@ -3397,7 +3564,7 @@ async function handleMindEvent(mind, event) {
         session: event.session,
         kind: "budget",
         reason: "token_budget",
-        detail: "You've reached your token budget for this period. Further activity may be paused until the budget resets \u2014 wrap up or prioritize accordingly."
+        detail: "You've used your token budget for this period, so your activity may pause until it resets. This isn't anything you did wrong \u2014 it's just a rest imposed by the budget. Anything that arrives while you're paused will be kept for you. If you're mid-thought, this turn is a good moment to jot it down."
       });
     }
   }
@@ -3427,18 +3594,18 @@ async function completeTurnAndSummarize(mind, event, insertedId) {
 
 // packages/daemon/src/lib/mind/consolidate.ts
 import { readdirSync, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
-import { resolve as resolve9 } from "path";
+import { resolve as resolve8 } from "path";
 async function consolidateMemory(mindDir2) {
-  const soulPath = resolve9(mindDir2, "home/SOUL.md");
-  const memoryPath = resolve9(mindDir2, "home/MEMORY.md");
-  const memoryDir = resolve9(mindDir2, "home/memory");
+  const soulPath = resolve8(mindDir2, "home/SOUL.md");
+  const memoryPath = resolve8(mindDir2, "home/MEMORY.md");
+  const memoryDir = resolve8(mindDir2, "home/memory");
   const soul = readFileSync6(soulPath, "utf-8");
   const logs = [];
   try {
     const files = readdirSync(memoryDir).filter((f) => /^\d{4}-\d{2}-\d{2}\.md$/.test(f)).sort();
     for (const filename of files) {
       const date = filename.replace(".md", "");
-      const content2 = readFileSync6(resolve9(memoryDir, filename), "utf-8").trim();
+      const content2 = readFileSync6(resolve8(memoryDir, filename), "utf-8").trim();
       if (content2) {
         logs.push(`### ${date}
 
@@ -3497,7 +3664,7 @@ ${content2}`);
 }
 
 // packages/daemon/src/lib/mind/last-known-good.ts
-import { randomBytes } from "crypto";
+import { randomBytes as randomBytes2 } from "crypto";
 var glog = logger_default.child("last-known-good");
 async function hasSrcChanges(dir, mindName) {
   const status = (await gitExec(["status", "--porcelain", "--", "src"], { cwd: dir, mindName })).trim();
@@ -3506,7 +3673,7 @@ async function hasSrcChanges(dir, mindName) {
 async function rollbackSrcChanges(dir, mindName) {
   if (!await hasSrcChanges(dir, mindName)) return { parked: false };
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const branch = `broken/${ts}-${randomBytes(4).toString("hex")}`;
+  const branch = `broken/${ts}-${randomBytes2(4).toString("hex")}`;
   const opts = { cwd: dir, mindName };
   await gitExec(["add", "--", "src"], opts);
   await gitExec(
@@ -3539,7 +3706,7 @@ async function cleanupVariant(variantName, projectRoot, variantPath, opts) {
       logger_default.warn(`failed to stop variant ${variantName}`, logger_default.errorData(err));
     }
   }
-  const { findMind: findMind2 } = await import("./registry-7LQHTRUX.js");
+  const { findMind: findMind2 } = await import("./registry-NUJAGLQJ.js");
   const variantEntry = await findMind2(variantName);
   const branchName = variantEntry?.branch ?? variantName;
   if (existsSync6(variantPath)) {
@@ -3591,7 +3758,7 @@ function validateBranchName(branch) {
 import { randomUUID } from "crypto";
 import { mkdirSync as mkdirSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
 import { homedir } from "os";
-import { resolve as resolve10 } from "path";
+import { resolve as resolve9 } from "path";
 function convertSession(opts) {
   const lines = readFileSync7(opts.sessionPath, "utf-8").trim().split("\n");
   const sessionId = randomUUID();
@@ -3707,9 +3874,9 @@ function convertSession(opts) {
     }
   }
   const projectId = opts.projectDir.replace(/\//g, "-");
-  const sdkDir = resolve10(homedir(), ".claude", "projects", projectId);
+  const sdkDir = resolve9(homedir(), ".claude", "projects", projectId);
   mkdirSync5(sdkDir, { recursive: true });
-  const sdkPath = resolve10(sdkDir, `${sessionId}.jsonl`);
+  const sdkPath = resolve9(sdkDir, `${sessionId}.jsonl`);
   writeFileSync6(sdkPath, `${sdkEvents.join("\n")}
 `);
   console.log(`Converted ${sdkEvents.length} messages \u2192 ${sdkPath}`);
@@ -3768,7 +3935,7 @@ async function getMindStatus(name, port, registryRunning) {
   const manager = getMindManager();
   let status = "stopped";
   try {
-    const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-AG5SQDDI.js");
+    const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-YAHDOIU5.js");
     if (getSleepManagerIfReady2()?.isSleeping(name)) {
       status = "sleeping";
     }
@@ -3814,7 +3981,7 @@ async function initTemplateBranch(projectRoot, composedDir, manifest, mindName,
   await gitExec(["commit", "-m", "initial commit"], opts);
 }
 async function updateTemplateBranch(projectRoot, template, mindName) {
-  const tempWorktree = resolve11(projectRoot, ".variants", "_template_update");
+  const tempWorktree = resolve10(projectRoot, ".variants", "_template_update");
   let branchExists = false;
   try {
     await gitExec(["rev-parse", "--verify", TEMPLATE_BRANCH], { cwd: projectRoot });
@@ -3846,15 +4013,15 @@ async function updateTemplateBranch(projectRoot, template, mindName) {
       });
     }
     copyTemplateToDir(composedDir, tempWorktree, mindName, manifest);
-    const initDir = resolve11(tempWorktree, ".init");
+    const initDir = resolve10(tempWorktree, ".init");
     if (existsSync7(initDir)) {
       rmSync4(initDir, { recursive: true, force: true });
     }
-    const homeDir = resolve11(tempWorktree, "home");
+    const homeDir = resolve10(tempWorktree, "home");
     if (existsSync7(homeDir)) {
       for (const entry of readdirSync2(homeDir)) {
         if (entry !== "VOLUTE.md") {
-          rmSync4(resolve11(homeDir, entry), { recursive: true, force: true });
+          rmSync4(resolve10(homeDir, entry), { recursive: true, force: true });
         }
       }
     }
@@ -3895,7 +4062,7 @@ async function mergeTemplateBranch(worktreeDir) {
 async function npmInstallAsMind(cwd, mindName) {
   if (isIsolationEnabled()) {
     const [cmd, args] = await wrapForIsolation("npm", ["install"], mindName);
-    await exec(cmd, args, { cwd, env: { ...process.env, HOME: resolve11(cwd, "home") } });
+    await exec(cmd, args, { cwd, env: { ...process.env, HOME: resolve10(cwd, "home") } });
   } else {
     await exec("npm", ["install"], { cwd });
   }
@@ -3920,7 +4087,7 @@ async function mergeUpgradeAndRestart(mindName, dir, worktreeDir, upgradeVariant
   let switchWarning;
   if (templateChanged) {
     try {
-      applyTemplateHomeFiles(resolve11(dir, "home"), template);
+      applyTemplateHomeFiles(resolve10(dir, "home"), template);
       await gitExec(["add", "home/"], { cwd: dir });
       try {
         await gitExec(["diff", "--cached", "--quiet"], { cwd: dir });
@@ -3970,7 +4137,7 @@ async function mergeUpgradeAndRestart(mindName, dir, worktreeDir, upgradeVariant
   return { ok: true, warning: switchWarning };
 }
 async function importFromArchive(c, tempDir, nameOverride, manifest) {
-  const extractedMindDir = resolve11(tempDir, "mind");
+  const extractedMindDir = resolve10(tempDir, "mind");
   if (!existsSync7(extractedMindDir)) {
     return c.json({ error: "Invalid archive: missing mind/ directory" }, 400);
   }
@@ -3997,9 +4164,9 @@ async function importFromFullArchive(c, tempDir, extractedMindDir, nameOverride,
     }
     const state = stateDir(name);
     mkdirSync6(state, { recursive: true });
-    const envJson = resolve11(tempDir, "state/env.json");
+    const envJson = resolve10(tempDir, "state/env.json");
     if (existsSync7(envJson)) {
-      cpSync(envJson, resolve11(state, "env.json"));
+      cpSync(envJson, resolve10(state, "env.json"));
     }
     const port = await nextPort();
     await addMind(name, port, manifest.stage, manifest.template);
@@ -4008,23 +4175,23 @@ async function importFromFullArchive(c, tempDir, extractedMindDir, nameOverride,
     } catch (err) {
       logger_default.warn(`failed to set template hash for ${name}`, logger_default.errorData(err));
     }
-    const homeDir = resolve11(dest, "home");
+    const homeDir = resolve10(dest, "home");
     ensureVoluteGroup();
     createMindUser(name, homeDir);
     await chownMindDir(dest, name);
     await npmInstallAsMind(dest, name);
     await importHistoryFromArchive(name, tempDir);
     importSessionsFromArchive(dest, tempDir);
-    if (!existsSync7(resolve11(dest, ".git"))) {
+    if (!existsSync7(resolve10(dest, ".git"))) {
       try {
-        const env = isIsolationEnabled() ? { ...process.env, HOME: resolve11(dest, "home") } : void 0;
+        const env = isIsolationEnabled() ? { ...process.env, HOME: resolve10(dest, "home") } : void 0;
         await gitExec(["init"], { cwd: dest, mindName: name, env });
         await configureGitIdentity(name, { cwd: dest, mindName: name, env });
         await gitExec(["add", "-A"], { cwd: dest, mindName: name, env });
         await gitExec(["commit", "-m", "import from archive"], { cwd: dest, mindName: name, env });
       } catch (err) {
         logger_default.error(`git setup failed for imported mind ${name}`, logger_default.errorData(err));
-        rmSync4(resolve11(dest, ".git"), { recursive: true, force: true });
+        rmSync4(resolve10(dest, ".git"), { recursive: true, force: true });
       }
     }
     await chownMindDir(dest, name);
@@ -4057,22 +4224,22 @@ async function importFromHomeOnlyArchive(c, tempDir, extractedMindDir, nameOverr
   try {
     copyTemplateToDir(composedDir, dest, name, templateManifest);
     applyInitFiles(dest);
-    const extractedHome = resolve11(extractedMindDir, "home");
+    const extractedHome = resolve10(extractedMindDir, "home");
     if (existsSync7(extractedHome)) {
-      cpSync(extractedHome, resolve11(dest, "home"), { recursive: true });
+      cpSync(extractedHome, resolve10(dest, "home"), { recursive: true });
     }
-    const extractedMindInternal = resolve11(extractedMindDir, ".mind");
+    const extractedMindInternal = resolve10(extractedMindDir, ".mind");
     if (existsSync7(extractedMindInternal)) {
-      cpSync(extractedMindInternal, resolve11(dest, ".mind"), { recursive: true });
+      cpSync(extractedMindInternal, resolve10(dest, ".mind"), { recursive: true });
     }
-    const identityDir = resolve11(dest, ".mind/identity");
+    const identityDir = resolve10(dest, ".mind/identity");
     let publicKeyPem;
-    if (!manifest.includes.identity || !existsSync7(resolve11(identityDir, "private.pem"))) {
+    if (!manifest.includes.identity || !existsSync7(resolve10(identityDir, "private.pem"))) {
       ({ publicKeyPem } = generateIdentity(dest));
     } else {
-      publicKeyPem = readFileSync8(resolve11(identityDir, "public.pem"), "utf-8");
+      publicKeyPem = readFileSync8(resolve10(identityDir, "public.pem"), "utf-8");
     }
-    const promptsPath = resolve11(dest, "home/.config/prompts.json");
+    const promptsPath = resolve10(dest, "home/.config/prompts.json");
     if (!existsSync7(promptsPath)) {
       const mindPrompts = await getMindPromptDefaults();
       writeFileSync7(promptsPath, `${JSON.stringify(mindPrompts, null, 2)}
@@ -4080,13 +4247,13 @@ async function importFromHomeOnlyArchive(c, tempDir, extractedMindDir, nameOverr
     }
     const state = stateDir(name);
     mkdirSync6(state, { recursive: true });
-    const envJson = resolve11(tempDir, "state/env.json");
+    const envJson = resolve10(tempDir, "state/env.json");
     if (existsSync7(envJson)) {
-      cpSync(envJson, resolve11(state, "env.json"));
+      cpSync(envJson, resolve10(state, "env.json"));
     }
     const port = await nextPort();
     await addMind(name, port, manifest.stage, manifest.template);
-    const homeDir = resolve11(dest, "home");
+    const homeDir = resolve10(dest, "home");
     ensureVoluteGroup();
     createMindUser(name, homeDir);
     await chownMindDir(dest, name);
@@ -4099,7 +4266,7 @@ async function importFromHomeOnlyArchive(c, tempDir, extractedMindDir, nameOverr
       await initTemplateBranch(dest, composedDir, templateManifest, name, env);
     } catch (err) {
       logger_default.error(`git setup failed for imported mind ${name}`, logger_default.errorData(err));
-      rmSync4(resolve11(dest, ".git"), { recursive: true, force: true });
+      rmSync4(resolve10(dest, ".git"), { recursive: true, force: true });
       gitWarning = "Git setup failed \u2014 variants and upgrades won't be available until git is initialized.";
     }
     const skillSet = manifest.stage === "seed" ? SEED_SKILLS : getStandardSkillsWithExtensions();
@@ -4142,7 +4309,7 @@ async function importFromHomeOnlyArchive(c, tempDir, extractedMindDir, nameOverr
   }
 }
 async function importHistoryFromArchive(name, tempDir) {
-  const historyJsonl = resolve11(tempDir, "history.jsonl");
+  const historyJsonl = resolve10(tempDir, "history.jsonl");
   if (!existsSync7(historyJsonl)) return;
   try {
     const db = await getDb();
@@ -4182,27 +4349,27 @@ async function importHistoryFromArchive(name, tempDir) {
   }
 }
 function importSessionsFromArchive(dest, tempDir) {
-  const sessionsDir = resolve11(tempDir, "sessions");
+  const sessionsDir = resolve10(tempDir, "sessions");
   if (!existsSync7(sessionsDir)) return;
   try {
-    const destSessions = resolve11(dest, ".mind/sessions");
+    const destSessions = resolve10(dest, ".mind/sessions");
     mkdirSync6(destSessions, { recursive: true });
     for (const file of readdirSync2(sessionsDir)) {
-      cpSync(resolve11(sessionsDir, file), resolve11(destSessions, file));
+      cpSync(resolve10(sessionsDir, file), resolve10(destSessions, file));
     }
   } catch (err) {
     logger_default.error("Failed to import sessions from archive", logger_default.errorData(err));
   }
 }
-var createMindSchema = z5.object({
-  name: z5.string(),
-  template: z5.string().optional(),
-  stage: z5.enum(["seed", "sprouted"]).optional(),
-  description: z5.string().optional(),
-  model: z5.string().optional(),
-  seedSoul: z5.string().optional(),
-  skills: z5.array(z5.string()).optional(),
-  createdBy: z5.string().optional()
+var createMindSchema = z6.object({
+  name: z6.string(),
+  template: z6.string().optional(),
+  stage: z6.enum(["seed", "sprouted"]).optional(),
+  description: z6.string().optional(),
+  model: z6.string().optional(),
+  seedSoul: z6.string().optional(),
+  skills: z6.array(z6.string()).optional(),
+  createdBy: z6.string().optional()
 });
 function formatTimeAgo(date) {
   const seconds = Math.floor((Date.now() - date.getTime()) / 1e3);
@@ -4246,7 +4413,7 @@ async function proxyToMind(c, path) {
     return c.json({ error: "Failed to reach mind" }, 503);
   }
 }
-var app13 = new Hono15().post("/", requireAdminOrSystem, zValidator5("json", createMindSchema), async (c) => {
+var app13 = new Hono16().post("/", requireAdminOrSystem, zValidator6("json", createMindSchema), async (c) => {
   const body = c.req.valid("json");
   const { name } = body;
   const template = body.template ?? await resolveTemplate(body.model);
@@ -4263,7 +4430,7 @@ var app13 = new Hono15().post("/", requireAdminOrSystem, zValidator5("json", cre
     applyInitFiles(dest);
     const { publicKeyPem } = generateIdentity(dest);
     {
-      const { readGlobalConfig: readGlobal } = await import("./setup-25MMJ3J4.js");
+      const { readGlobalConfig: readGlobal } = await import("./setup-73YBJZQL.js");
       const mindDefaults = readGlobal().mindDefaults;
       const config2 = readVoluteConfig(dest);
       if (!config2) throw new Error("Failed to read volute.json after identity generation");
@@ -4300,7 +4467,7 @@ var app13 = new Hono15().post("/", requireAdminOrSystem, zValidator5("json", cre
       }
       writeVoluteConfig(dest, config2);
       const modelId = body.model ?? cog?.model;
-      const sdkConfigPath = resolve11(dest, "home/.config/config.json");
+      const sdkConfigPath = resolve10(dest, "home/.config/config.json");
       if (modelId || cog?.compaction) {
         const existing = existsSync7(sdkConfigPath) ? JSON.parse(readFileSync8(sdkConfigPath, "utf-8")) : {};
         if (modelId) {
@@ -4315,7 +4482,7 @@ var app13 = new Hono15().post("/", requireAdminOrSystem, zValidator5("json", cre
     }
     const mindPrompts = await getMindPromptDefaults();
     writeFileSync7(
-      resolve11(dest, "home/.config/prompts.json"),
+      resolve10(dest, "home/.config/prompts.json"),
       `${JSON.stringify(mindPrompts, null, 2)}
 `
     );
@@ -4327,7 +4494,7 @@ var app13 = new Hono15().post("/", requireAdminOrSystem, zValidator5("json", cre
     } catch (err) {
       logger_default.warn(`failed to set template hash for ${name}`, logger_default.errorData(err));
     }
-    const homeDir = resolve11(dest, "home");
+    const homeDir = resolve10(dest, "home");
     ensureVoluteGroup();
     createMindUser(name, homeDir);
     await chownMindDir(dest, name);
@@ -4340,7 +4507,7 @@ var app13 = new Hono15().post("/", requireAdminOrSystem, zValidator5("json", cre
       await initTemplateBranch(dest, composedDir, manifest, name, env);
     } catch (err) {
       logger_default.error(`git setup failed for ${name}`, logger_default.errorData(err));
-      rmSync4(resolve11(dest, ".git"), { recursive: true, force: true });
+      rmSync4(resolve10(dest, ".git"), { recursive: true, force: true });
       gitWarning = "Git setup failed \u2014 variants and upgrades won't be available until git is initialized.";
     }
     await chownMindDir(dest, name);
@@ -4350,11 +4517,11 @@ The human who planted you described you as: "${body.description}"
 ` : "";
       const seedSoulRaw = body.seedSoul ?? await getPrompt("seed_soul", { name, description: descLine });
       const seedSoul = body.seedSoul ? substitute(seedSoulRaw, { name, description: descLine }) : seedSoulRaw;
-      writeFileSync7(resolve11(dest, "home/SOUL.md"), seedSoul);
+      writeFileSync7(resolve10(dest, "home/SOUL.md"), seedSoul);
     }
     let skillSet = body.skills ?? (body.stage === "seed" ? SEED_SKILLS : getStandardSkillsWithExtensions());
     if (body.stage === "seed" && !body.skills) {
-      const { isImagegenEnabled } = await import("./setup-25MMJ3J4.js");
+      const { isImagegenEnabled } = await import("./setup-73YBJZQL.js");
       if (isImagegenEnabled()) {
         skillSet = [...skillSet, "imagegen"];
       }
@@ -4372,7 +4539,7 @@ The human who planted you described you as: "${body.description}"
       try {
         const spiritEntry = await findMind("volute");
         if (spiritEntry) {
-          const { spiritDir } = await import("./spirit-53DQPRNR.js");
+          const { spiritDir } = await import("./spirit-II3HOERM.js");
           const sDir = spiritEntry.dir ?? spiritDir();
           const spiritConfig = readVoluteConfig(sDir) ?? {};
           const schedules = spiritConfig.schedules ?? [];
@@ -4387,7 +4554,7 @@ The human who planted you described you as: "${body.description}"
             });
             spiritConfig.schedules = schedules;
             writeVoluteConfig(sDir, spiritConfig);
-            const { getScheduler: getScheduler2 } = await import("./scheduler-VON2TB52.js");
+            const { getScheduler: getScheduler2 } = await import("./scheduler-YHJRRV6E.js");
             getScheduler2().loadSchedules("volute", sDir);
           }
         }
@@ -4398,11 +4565,11 @@ The human who planted you described you as: "${body.description}"
     if (body.stage !== "seed") {
       const customSoul = await getPromptIfCustom("default_soul");
       if (customSoul) {
-        writeFileSync7(resolve11(dest, "home/SOUL.md"), customSoul.replace(/\{\{name\}\}/g, name));
+        writeFileSync7(resolve10(dest, "home/SOUL.md"), customSoul.replace(/\{\{name\}\}/g, name));
       }
       const customMemory = await getPromptIfCustom("default_memory");
       if (customMemory) {
-        writeFileSync7(resolve11(dest, "home/MEMORY.md"), customMemory);
+        writeFileSync7(resolve10(dest, "home/MEMORY.md"), customMemory);
       }
     }
     publishPublicKey(name, publicKeyPem).catch(
@@ -4451,12 +4618,12 @@ The human who planted you described you as: "${body.description}"
     return importFromArchive(c, body.archivePath, body.name, body.manifest);
   }
   const wsDir = body.workspacePath;
-  if (!wsDir || !existsSync7(resolve11(wsDir, "SOUL.md")) || !existsSync7(resolve11(wsDir, "IDENTITY.md"))) {
+  if (!wsDir || !existsSync7(resolve10(wsDir, "SOUL.md")) || !existsSync7(resolve10(wsDir, "IDENTITY.md"))) {
     return c.json({ error: "Invalid workspace: missing SOUL.md or IDENTITY.md" }, 400);
   }
-  const soul = readFileSync8(resolve11(wsDir, "SOUL.md"), "utf-8");
-  const identity = readFileSync8(resolve11(wsDir, "IDENTITY.md"), "utf-8");
-  const userPath = resolve11(wsDir, "USER.md");
+  const soul = readFileSync8(resolve10(wsDir, "SOUL.md"), "utf-8");
+  const identity = readFileSync8(resolve10(wsDir, "IDENTITY.md"), "utf-8");
+  const userPath = resolve10(wsDir, "USER.md");
   const user = existsSync7(userPath) ? readFileSync8(userPath, "utf-8") : "";
   const name = body.name ?? parseNameFromIdentity(identity) ?? "imported-mind";
   const template = body.template ?? "claude";
@@ -4484,26 +4651,26 @@ ${user.trimEnd()}
     copyTemplateToDir(composedDir, dest, name, manifest);
     applyInitFiles(dest);
     const { publicKeyPem: importPublicKey } = generateIdentity(dest);
-    writeFileSync7(resolve11(dest, "home/SOUL.md"), mergedSoul);
-    const wsMemoryPath = resolve11(wsDir, "MEMORY.md");
+    writeFileSync7(resolve10(dest, "home/SOUL.md"), mergedSoul);
+    const wsMemoryPath = resolve10(wsDir, "MEMORY.md");
     const hasMemory = existsSync7(wsMemoryPath);
     if (hasMemory) {
       const existingMemory = readFileSync8(wsMemoryPath, "utf-8");
       writeFileSync7(
-        resolve11(dest, "home/MEMORY.md"),
+        resolve10(dest, "home/MEMORY.md"),
         `${existingMemory.trimEnd()}${mergedMemoryExtra}`
       );
     } else if (user) {
-      writeFileSync7(resolve11(dest, "home/MEMORY.md"), `${user.trimEnd()}
+      writeFileSync7(resolve10(dest, "home/MEMORY.md"), `${user.trimEnd()}
 `);
     }
-    const wsMemoryDir = resolve11(wsDir, "memory");
+    const wsMemoryDir = resolve10(wsDir, "memory");
     let dailyLogCount = 0;
     if (existsSync7(wsMemoryDir)) {
-      const destMemoryDir = resolve11(dest, "home/memory");
+      const destMemoryDir = resolve10(dest, "home/memory");
       const files = readdirSync2(wsMemoryDir).filter((f) => f.endsWith(".md"));
       for (const file of files) {
-        cpSync(resolve11(wsMemoryDir, file), resolve11(destMemoryDir, file));
+        cpSync(resolve10(wsMemoryDir, file), resolve10(destMemoryDir, file));
       }
       dailyLogCount = files.length;
     }
@@ -4514,7 +4681,7 @@ ${user.trimEnd()}
     } catch (err) {
       logger_default.warn(`failed to set template hash for ${name}`, logger_default.errorData(err));
     }
-    const homeDir = resolve11(dest, "home");
+    const homeDir = resolve10(dest, "home");
     ensureVoluteGroup();
     createMindUser(name, homeDir);
     await chownMindDir(dest, name);
@@ -4522,20 +4689,20 @@ ${user.trimEnd()}
     if (!hasMemory && dailyLogCount > 0) {
       await consolidateMemory(dest);
     }
-    const env = isIsolationEnabled() ? { ...process.env, HOME: resolve11(dest, "home") } : void 0;
+    const env = isIsolationEnabled() ? { ...process.env, HOME: resolve10(dest, "home") } : void 0;
     await gitExec(["init"], { cwd: dest, mindName: name, env });
     await configureGitIdentity(name, { cwd: dest, mindName: name, env });
     await gitExec(["add", "-A"], { cwd: dest, mindName: name, env });
     await gitExec(["commit", "-m", "import from OpenClaw"], { cwd: dest, mindName: name, env });
-    const sessionFile = body.sessionPath ? resolve11(body.sessionPath) : findOpenClawSession(wsDir);
+    const sessionFile = body.sessionPath ? resolve10(body.sessionPath) : findOpenClawSession(wsDir);
     if (sessionFile && existsSync7(sessionFile)) {
       if (template === "pi") {
         importPiSession(sessionFile, dest);
       } else if (template === "claude") {
         const sessionId = convertSession({ sessionPath: sessionFile, projectDir: dest });
-        const mindRuntimeDir = resolve11(dest, ".mind");
+        const mindRuntimeDir = resolve10(dest, ".mind");
         mkdirSync6(mindRuntimeDir, { recursive: true });
-        writeFileSync7(resolve11(mindRuntimeDir, "session.json"), JSON.stringify({ sessionId }));
+        writeFileSync7(resolve10(mindRuntimeDir, "session.json"), JSON.stringify({ sessionId }));
       }
     }
     importOpenClawConnectors(name, dest);
@@ -4576,7 +4743,7 @@ ${user.trimEnd()}
   const minds = await Promise.all(
     entries.map(async (entry) => {
       const mindStatus = await getMindStatus(entry.name, entry.port, entry.running);
-      const hasPages = existsSync7(resolve11(mindDir(entry.name), "home", "pages"));
+      const hasPages = existsSync7(resolve10(mindDir(entry.name), "home", "pages"));
       return {
         ...entry,
         ...mindStatus,
@@ -4605,7 +4772,7 @@ ${user.trimEnd()}
       return { name: s.name, port: s.port, status: variantStatus };
     })
   );
-  const hasPages = existsSync7(resolve11(mindDir(name), "home", "pages"));
+  const hasPages = existsSync7(resolve10(mindDir(name), "home", "pages"));
   return c.json({ ...entry, ...mindStatus, variants: variantStatuses, hasPages });
 }).get("/:name/context", requireSelf(), async (c) => proxyToMind(c, "context")).get("/:name/context/messages", requireSelf(), async (c) => proxyToMind(c, "context/messages")).post("/:name/start", requireSelf(), async (c) => {
   const name = c.req.param("name");
@@ -4652,7 +4819,7 @@ ${user.trimEnd()}
   const manager = getMindManager();
   try {
     if (context?.type === "reload") {
-      const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-AG5SQDDI.js");
+      const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-YAHDOIU5.js");
       const sleepState = getSleepManagerIfReady2()?.getState(name);
       if (sleepState?.sleeping) {
         logger_default.info(`skipping reload for ${name} during sleep \u2014 will apply on next wake`);
@@ -4779,7 +4946,7 @@ ${user.trimEnd()}
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-AG5SQDDI.js");
+  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-YAHDOIU5.js");
   const sm = getSleepManagerIfReady2();
   if (!sm) return c.json({ error: "Sleep manager not initialized" }, 503);
   return c.json(sm.getState(name));
@@ -4787,7 +4954,7 @@ ${user.trimEnd()}
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-AG5SQDDI.js");
+  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-YAHDOIU5.js");
   const sm = getSleepManagerIfReady2();
   if (!sm) return c.json({ error: "Sleep manager not initialized" }, 503);
   if (sm.isSleeping(name)) return c.json({ error: "Mind is already sleeping" }, 409);
@@ -4807,7 +4974,7 @@ ${user.trimEnd()}
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-AG5SQDDI.js");
+  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-YAHDOIU5.js");
   const sm = getSleepManagerIfReady2();
   if (!sm) return c.json({ error: "Sleep manager not initialized" }, 503);
   const sleepState = sm.getState(name);
@@ -4822,7 +4989,7 @@ ${user.trimEnd()}
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-AG5SQDDI.js");
+  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-YAHDOIU5.js");
   const sm = getSleepManagerIfReady2();
   if (!sm) return c.json({ error: "Sleep manager not initialized" }, 503);
   const flushed = await sm.flushQueuedMessages(name);
@@ -4837,10 +5004,20 @@ ${user.trimEnd()}
   const profile = config2.profile ?? {};
   if (body.displayName !== void 0) profile.displayName = body.displayName;
   if (body.description !== void 0) profile.description = body.description;
-  if (body.avatar !== void 0) profile.avatar = basename(body.avatar);
+  if (body.avatar !== void 0) {
+    const homeDir = resolve10(dir, "home");
+    const avatarPath = safeResolveWithinBase(homeDir, body.avatar);
+    if (!avatarPath) {
+      return c.json({ error: "Avatar path must be inside the mind's home directory" }, 400);
+    }
+    if (!existsSync7(avatarPath)) {
+      return c.json({ error: `Avatar file not found: ${relative(homeDir, avatarPath)}` }, 400);
+    }
+    profile.avatar = relative(homeDir, avatarPath);
+  }
   config2.profile = profile;
   writeVoluteConfig(dir, config2);
-  const { syncMindProfile: syncMindProfile2 } = await import("./auth-3RIG6GKN.js");
+  const { syncMindProfile: syncMindProfile2 } = await import("./auth-FRZJVQCS.js");
   await syncMindProfile2(name, profile);
   broadcast({ type: "profile_updated", mind: name, summary: `${name} profile updated` });
   return c.json({ ok: true });
@@ -4880,14 +5057,14 @@ ${user.trimEnd()}
     return c.json({ output: "" });
   }
   const dir = entry.dir ?? mindDir(name);
-  const soulPath = resolve11(dir, "home/SOUL.md");
-  const memoryPath = resolve11(dir, "home/MEMORY.md");
+  const soulPath = resolve10(dir, "home/SOUL.md");
+  const memoryPath = resolve10(dir, "home/MEMORY.md");
   const soulCustom = existsSync7(soulPath) && !readFileSync8(soulPath, "utf-8").includes(ORIENTATION_MARKER);
   const memoryWritten = existsSync7(memoryPath) && readFileSync8(memoryPath, "utf-8").trim().length > 0;
   const config2 = readVoluteConfig(dir);
   const displayNameSet = !!config2?.profile?.displayName;
   const avatarSet = !!config2?.profile?.avatar;
-  const { isImagegenEnabled } = await import("./setup-25MMJ3J4.js");
+  const { isImagegenEnabled } = await import("./setup-73YBJZQL.js");
   const imagegenEnabled = isImagegenEnabled();
   const done = [];
   const remaining = [];
@@ -4925,7 +5102,7 @@ ${user.trimEnd()}
   try {
     const spiritEntry = await findMind("volute");
     if (spiritEntry) {
-      const { spiritDir } = await import("./spirit-53DQPRNR.js");
+      const { spiritDir } = await import("./spirit-II3HOERM.js");
       const sDir = spiritEntry.dir ?? spiritDir();
       const spiritConfig = readVoluteConfig(sDir);
       if (spiritConfig?.schedules) {
@@ -4933,7 +5110,7 @@ ${user.trimEnd()}
         spiritConfig.schedules = spiritConfig.schedules.filter((s) => s.id !== nurtureId);
         if (spiritConfig.schedules.length === 0) spiritConfig.schedules = void 0;
         writeVoluteConfig(sDir, spiritConfig);
-        const { getScheduler: getScheduler2 } = await import("./scheduler-VON2TB52.js");
+        const { getScheduler: getScheduler2 } = await import("./scheduler-YHJRRV6E.js");
         getScheduler2().loadSchedules("volute", sDir);
       }
     }
@@ -4992,16 +5169,16 @@ ${user.trimEnd()}
   }
   const UPGRADE_BRANCH = "upgrade";
   const upgradeVariantName = `${mindName}-upgrade`;
-  const worktreeDir = resolve11(dir, ".variants", UPGRADE_BRANCH);
+  const worktreeDir = resolve10(dir, ".variants", UPGRADE_BRANCH);
   if (body.abort) {
     if (!existsSync7(worktreeDir)) {
       return c.json({ error: "No upgrade in progress" }, 400);
     }
     try {
       try {
-        const gitDirContent = readFileSync8(resolve11(worktreeDir, ".git"), "utf-8").trim();
+        const gitDirContent = readFileSync8(resolve10(worktreeDir, ".git"), "utf-8").trim();
         const gitDir = gitDirContent.replace("gitdir: ", "");
-        if (existsSync7(resolve11(gitDir, "MERGE_HEAD"))) {
+        if (existsSync7(resolve10(gitDir, "MERGE_HEAD"))) {
           await gitExec(["merge", "--abort"], { cwd: worktreeDir });
         }
       } catch {
@@ -5085,7 +5262,7 @@ ${user.trimEnd()}
   }
   if (body.diff) {
     try {
-      if (!existsSync7(resolve11(dir, ".git"))) {
+      if (!existsSync7(resolve10(dir, ".git"))) {
         return c.json({ error: "Mind has no git history \u2014 nothing to diff against" }, 400);
       }
       await updateTemplateBranch(dir, template, mindName);
@@ -5109,16 +5286,16 @@ ${user.trimEnd()}
       409
     );
   }
-  if (!existsSync7(resolve11(dir, ".git"))) {
+  if (!existsSync7(resolve10(dir, ".git"))) {
     try {
-      const env = isIsolationEnabled() ? { ...process.env, HOME: resolve11(dir, "home") } : void 0;
+      const env = isIsolationEnabled() ? { ...process.env, HOME: resolve10(dir, "home") } : void 0;
       await gitExec(["init"], { cwd: dir, mindName, env });
       await configureGitIdentity(mindName, { cwd: dir, mindName, env });
       await gitExec(["add", "-A"], { cwd: dir, mindName, env });
       await gitExec(["commit", "-m", "initial commit"], { cwd: dir, mindName, env });
       await chownMindDir(dir, mindName);
     } catch (err) {
-      rmSync4(resolve11(dir, ".git"), { recursive: true, force: true });
+      rmSync4(resolve10(dir, ".git"), { recursive: true, force: true });
       return c.json(
         {
           error: `Git initialization failed: ${err instanceof Error ? err.message : String(err)}`
@@ -5133,7 +5310,7 @@ ${user.trimEnd()}
   } catch {
   }
   await updateTemplateBranch(dir, template, mindName);
-  const parentDir = resolve11(dir, ".variants");
+  const parentDir = resolve10(dir, ".variants");
   if (!existsSync7(parentDir)) {
     mkdirSync6(parentDir, { recursive: true });
   }
@@ -5267,7 +5444,7 @@ ${user.trimEnd()}
   if (!existsSync7(dir)) return c.json({ error: "Mind directory missing" }, 404);
   let config2 = readVoluteConfig(dir);
   if (!config2 && entry.template === "pi") {
-    const piConfigPath = resolve11(dir, "home/.config/config.json");
+    const piConfigPath = resolve10(dir, "home/.config/config.json");
     if (existsSync7(piConfigPath)) {
       try {
         config2 = JSON.parse(readFileSync8(piConfigPath, "utf-8"));
@@ -5276,7 +5453,7 @@ ${user.trimEnd()}
     }
   }
   let templateConfig = {};
-  const configJsonPath = resolve11(dir, "home/.config/config.json");
+  const configJsonPath = resolve10(dir, "home/.config/config.json");
   if (existsSync7(configJsonPath)) {
     try {
       templateConfig = JSON.parse(readFileSync8(configJsonPath, "utf-8"));
@@ -5318,16 +5495,16 @@ ${user.trimEnd()}
 }).put(
   "/:name/config",
   requireSelf(),
-  zValidator5(
+  zValidator6(
     "json",
-    z5.object({
-      model: z5.string().optional(),
-      thinkingLevel: z5.enum(["off", "minimal", "low", "medium", "high", "xhigh"]).optional(),
-      maxThinkingTokens: z5.number().int().positive().nullable().optional(),
-      tokenBudget: z5.number().int().positive().nullable().optional(),
-      tokenBudgetPeriodMinutes: z5.number().int().positive().nullable().optional(),
-      compaction: z5.object({ maxContextTokens: z5.number().int().positive().nullable().optional() }).nullable().optional(),
-      unescapeNewlines: z5.boolean().optional()
+    z6.object({
+      model: z6.string().optional(),
+      thinkingLevel: z6.enum(["off", "minimal", "low", "medium", "high", "xhigh"]).optional(),
+      maxThinkingTokens: z6.number().int().positive().nullable().optional(),
+      tokenBudget: z6.number().int().positive().nullable().optional(),
+      tokenBudgetPeriodMinutes: z6.number().int().positive().nullable().optional(),
+      compaction: z6.object({ maxContextTokens: z6.number().int().positive().nullable().optional() }).nullable().optional(),
+      unescapeNewlines: z6.boolean().optional()
     })
   ),
   async (c) => {
@@ -5368,12 +5545,12 @@ ${user.trimEnd()}
     }
     writeVoluteConfig(dir, existing);
     if (body.unescapeNewlines !== void 0) {
-      const { clearEchoTextCache } = await import("./echo-text-KFSUCZXL.js");
+      const { clearEchoTextCache } = await import("./echo-text-NQXYYYCU.js");
       clearEchoTextCache(name);
     }
     const needsConfigJson = body.model !== void 0 || body.thinkingLevel !== void 0 || body.maxThinkingTokens !== void 0 || body.compaction !== void 0;
     if (needsConfigJson) {
-      const configJsonPath = resolve11(dir, "home/.config/config.json");
+      const configJsonPath = resolve10(dir, "home/.config/config.json");
       let templateConfig = {};
       if (existsSync7(configJsonPath)) {
         try {
@@ -5445,7 +5622,7 @@ ${user.trimEnd()}
     }
     if (entry.mindType === "spirit" && body.model !== void 0) {
       try {
-        const { readGlobalConfig: readGlobalConfig2, writeGlobalConfig: writeGlobalConfig2 } = await import("./setup-25MMJ3J4.js");
+        const { readGlobalConfig: readGlobalConfig2, writeGlobalConfig: writeGlobalConfig2 } = await import("./setup-73YBJZQL.js");
         const globalConfig = readGlobalConfig2();
         globalConfig.spiritModel = body.model;
         writeGlobalConfig2(globalConfig);
@@ -5473,7 +5650,7 @@ ${user.trimEnd()}
   if (!body.systemPrompt || !body.message) {
     return c.json({ error: "systemPrompt and message required" }, 400);
   }
-  const { aiComplete: aiCompleteFn, isAiConfigured } = await import("./ai-service-FBCCEYF5.js");
+  const { aiComplete: aiCompleteFn, isAiConfigured } = await import("./ai-service-534WUSDL.js");
   if (!isAiConfigured()) {
     return c.json({ error: "AI service not configured" }, 503);
   }
@@ -5765,11 +5942,11 @@ ${lines.join("\n")}` });
 var minds_default = app13;
 
 // packages/daemon/src/web/api/prompts.ts
-import { zValidator as zValidator6 } from "@hono/zod-validator";
+import { zValidator as zValidator7 } from "@hono/zod-validator";
 import { eq as eq6, sql as sql4 } from "drizzle-orm";
-import { Hono as Hono16 } from "hono";
-import { z as z6 } from "zod";
-var app14 = new Hono16().get("/", async (c) => {
+import { Hono as Hono17 } from "hono";
+import { z as z7 } from "zod";
+var app14 = new Hono17().get("/", async (c) => {
   let rows;
   try {
     const db = await getDb();
@@ -5792,7 +5969,7 @@ var app14 = new Hono16().get("/", async (c) => {
     };
   });
   return c.json(prompts);
-}).put("/:key", requireAdmin, zValidator6("json", z6.object({ content: z6.string() })), async (c) => {
+}).put("/:key", requireAdmin, zValidator7("json", z7.object({ content: z7.string() })), async (c) => {
   const key = c.req.param("key");
   if (!PROMPT_KEYS.includes(key)) {
     return c.json({ error: "Unknown prompt key" }, 404);
@@ -5816,8 +5993,8 @@ var app14 = new Hono16().get("/", async (c) => {
 var prompts_default = app14;
 
 // packages/daemon/src/web/api/schedules.ts
-import { CronExpressionParser } from "cron-parser";
-import { Hono as Hono17 } from "hono";
+import { CronExpressionParser as CronExpressionParser3 } from "cron-parser";
+import { Hono as Hono18 } from "hono";
 var slog2 = logger_default.child("schedules");
 function readSchedules(dir) {
   return readVoluteConfig(dir)?.schedules ?? [];
@@ -5834,7 +6011,7 @@ function writeSchedules(name, dir, schedules) {
     data: { schedules }
   });
 }
-var app15 = new Hono17().get("/:name/clock/status", requireSelf(), async (c) => {
+var app15 = new Hono18().get("/:name/clock/status", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
@@ -5855,14 +6032,14 @@ var app15 = new Hono17().get("/:name/clock/status", requireSelf(), async (c) =>
       }
     } else if (s.cron) {
       try {
-        const interval = CronExpressionParser.parse(s.cron);
+        const interval = CronExpressionParser3.parse(s.cron);
         const next = interval.next().toDate();
         upcoming.push({ id: s.id, at: next.toISOString(), type: "cron" });
       } catch {
         slog2.warn(`invalid cron "${s.cron}" for schedule "${s.id}" of ${name}`);
       }
       try {
-        const prevInterval = CronExpressionParser.parse(s.cron);
+        const prevInterval = CronExpressionParser3.parse(s.cron);
         const prev = prevInterval.prev().toDate();
         previous.push({ id: s.id, at: prev.toISOString() });
       } catch {
@@ -5878,13 +6055,13 @@ var app15 = new Hono17().get("/:name/clock/status", requireSelf(), async (c) =>
     }
   } else if (sleepConfig?.enabled && sleepConfig.schedule) {
     try {
-      const sleepInterval = CronExpressionParser.parse(sleepConfig.schedule.sleep);
+      const sleepInterval = CronExpressionParser3.parse(sleepConfig.schedule.sleep);
       const nextSleep = sleepInterval.next().toDate();
       upcoming.push({ id: "sleep", at: nextSleep.toISOString(), type: "cron" });
     } catch {
     }
     try {
-      const prevWakeInterval = CronExpressionParser.parse(sleepConfig.schedule.wake);
+      const prevWakeInterval = CronExpressionParser3.parse(sleepConfig.schedule.wake);
       const prevWake = prevWakeInterval.prev().toDate();
       previous.push({ id: "sleep", at: prevWake.toISOString() });
     } catch {
@@ -5908,7 +6085,7 @@ var app15 = new Hono17().get("/:name/clock/status", requireSelf(), async (c) =>
     for (const field of ["sleep", "wake"]) {
       if (body.schedule[field]) {
         try {
-          CronExpressionParser.parse(body.schedule[field]);
+          CronExpressionParser3.parse(body.schedule[field]);
         } catch {
           return c.json({ error: `Invalid ${field} cron: ${body.schedule[field]}` }, 400);
         }
@@ -5954,7 +6131,7 @@ var app15 = new Hono17().get("/:name/clock/status", requireSelf(), async (c) =>
   }
   if (body.cron) {
     try {
-      CronExpressionParser.parse(body.cron);
+      CronExpressionParser3.parse(body.cron);
     } catch {
       return c.json({ error: `Invalid cron expression: ${body.cron}` }, 400);
     }
@@ -6001,7 +6178,7 @@ var app15 = new Hono17().get("/:name/clock/status", requireSelf(), async (c) =>
   }
   if (body.cron !== void 0) {
     try {
-      CronExpressionParser.parse(body.cron);
+      CronExpressionParser3.parse(body.cron);
     } catch {
       return c.json({ error: `Invalid cron expression: ${body.cron}` }, 400);
     }
@@ -6058,7 +6235,7 @@ var app15 = new Hono17().get("/:name/clock/status", requireSelf(), async (c) =>
   const body = await c.req.text();
   const message = `[webhook: ${event}] ${body}`;
   try {
-    const { sendSystemMessage } = await import("./system-chat-54RN3K67.js");
+    const { sendSystemMessage } = await import("./system-chat-E65T2HSW.js");
     await sendSystemMessage(name, message);
     return c.json({ ok: true });
   } catch (err) {
@@ -6071,14 +6248,14 @@ var schedules_default = app15;
 // packages/daemon/src/web/api/setup.ts
 import { mkdirSync as mkdirSync7 } from "fs";
 import { homedir as homedir2 } from "os";
-import { resolve as resolve12 } from "path";
-import { Hono as Hono18 } from "hono";
+import { resolve as resolve11 } from "path";
+import { Hono as Hono19 } from "hono";
 import { setCookie as setCookie2 } from "hono/cookie";
 var DEFAULT_API_URL2 = "https://volute.systems";
-var setup = new Hono18();
+var setup = new Hono19();
 function writeSetupConfig(systemName, description) {
-  const configHome = process.env.VOLUTE_HOME ?? resolve12(homedir2(), ".volute");
-  const mindsDir = resolve12(configHome, "minds");
+  const configHome = process.env.VOLUTE_HOME ?? resolve11(homedir2(), ".volute");
+  const mindsDir = resolve11(configHome, "minds");
   mkdirSync7(configHome, { recursive: true });
   mkdirSync7(mindsDir, { recursive: true });
   const existingConfig = readGlobalConfig();
@@ -6112,7 +6289,7 @@ setup.get("/status", async (c) => {
   let hasAccount = false;
   if (hasSystem) {
     try {
-      const { listUsersByType: listUsersByType2 } = await import("./auth-3RIG6GKN.js");
+      const { listUsersByType: listUsersByType2 } = await import("./auth-FRZJVQCS.js");
       const brains = await listUsersByType2("brain");
       hasAccount = brains.length > 0;
     } catch (err) {
@@ -6323,7 +6500,7 @@ setup.post("/account", async (c) => {
     }
   }
   try {
-    const { createUser: createUser2, updateUserProfile: updateUserProfile2 } = await import("./auth-3RIG6GKN.js");
+    const { createUser: createUser2, updateUserProfile: updateUserProfile2 } = await import("./auth-FRZJVQCS.js");
     const user = await createUser2(body.username.trim(), body.password);
     if (body.displayName?.trim()) {
       await updateUserProfile2(user.id, { display_name: body.displayName.trim() });
@@ -6369,7 +6546,7 @@ setup.post("/models", async (c) => {
     return c.json({ error: "Spirit model is required" }, 400);
   }
   try {
-    const { setEnabledModels: setEnabledModels3, setUtilityModel: setUtilityModel2 } = await import("./ai-service-FBCCEYF5.js");
+    const { setEnabledModels: setEnabledModels3, setUtilityModel: setUtilityModel2 } = await import("./ai-service-534WUSDL.js");
     setEnabledModels3(body.models);
     const config2 = readGlobalConfig();
     config2.spiritModel = body.spiritModel.trim();
@@ -6387,15 +6564,15 @@ setup.post("/complete", async (c) => {
     return c.json({ error: "Setup already complete" }, 400);
   }
   try {
-    const { ensureSpiritProject, syncSpiritTemplate } = await import("./spirit-53DQPRNR.js");
-    const { startSpiritFull } = await import("./mind-service-2C7AINBO.js");
+    const { ensureSpiritProject, syncSpiritTemplate } = await import("./spirit-II3HOERM.js");
+    const { startSpiritFull } = await import("./mind-service-BF2LUQMH.js");
     await ensureSpiritProject();
     await syncSpiritTemplate();
     const warnings = [];
     const config2 = readGlobalConfig();
     if (config2.setup?.service && config2.setup?.type === "local") {
       try {
-        const { installUserService } = await import("./service-install-SHRM6NHK.js");
+        const { installUserService } = await import("./service-install-4QNUDKLM.js");
         const installed = await installUserService(config2.port, config2.hostname);
         if (!installed) {
           warnings.push("Service installation is not supported on this platform.");
@@ -6423,8 +6600,8 @@ setup.post("/complete", async (c) => {
     }
     let spiritConversationId;
     try {
-      const { getOrCreateMindUser: getOrCreateMindUser2, listUsersByType: listUsersByType2 } = await import("./auth-3RIG6GKN.js");
-      const { createConversation: createConversation2, findDMConversation: findDMConversation2 } = await import("./conversations-67WWW25C.js");
+      const { getOrCreateMindUser: getOrCreateMindUser2, listUsersByType: listUsersByType2 } = await import("./auth-FRZJVQCS.js");
+      const { createConversation: createConversation2, findDMConversation: findDMConversation2 } = await import("./conversations-G4LYMHAA.js");
       const spiritUser = await getOrCreateMindUser2("volute");
       const brains = await listUsersByType2("brain");
       const admin2 = brains.find((u) => u.role === "admin");
@@ -6446,8 +6623,8 @@ setup.post("/complete", async (c) => {
     logger_default.info("setup complete state", { spiritConversationId, spiritStarted });
     if (spiritConversationId && spiritStarted) {
       try {
-        const { deliverMessage: deliverMessage2 } = await import("./message-delivery-HRGFNWO7.js");
-        const { listUsersByType: listUsers2 } = await import("./auth-3RIG6GKN.js");
+        const { deliverMessage: deliverMessage2 } = await import("./message-delivery-IUAXRPFE.js");
+        const { listUsersByType: listUsers2 } = await import("./auth-FRZJVQCS.js");
         const admins = await listUsers2("brain");
         const admin2 = admins.find((u) => u.role === "admin");
         const adminName = admin2?.display_name || admin2?.username || "the admin";
@@ -6486,10 +6663,10 @@ var setup_default = setup;
 // packages/daemon/src/web/api/skills.ts
 import { existsSync as existsSync8, mkdtempSync, readdirSync as readdirSync3, rmSync as rmSync5 } from "fs";
 import { tmpdir } from "os";
-import { join, resolve as resolve13 } from "path";
+import { join, resolve as resolve12 } from "path";
 import AdmZip from "adm-zip";
-import { Hono as Hono19 } from "hono";
-var app16 = new Hono19().get("/", async (c) => {
+import { Hono as Hono20 } from "hono";
+var app16 = new Hono20().get("/", async (c) => {
   const skills = await listSharedSkills();
   return c.json(skills);
 }).get("/defaults/list", async (c) => {
@@ -6562,7 +6739,7 @@ var app16 = new Hono19().get("/", async (c) => {
   try {
     const zip = new AdmZip(buffer2);
     for (const entry of zip.getEntries()) {
-      const target = resolve13(tmpDir, entry.entryName);
+      const target = resolve12(tmpDir, entry.entryName);
       if (!target.startsWith(tmpDir)) {
         return c.json({ error: "Invalid zip: paths must not escape archive" }, 400);
       }
@@ -6613,15 +6790,15 @@ var app16 = new Hono19().get("/", async (c) => {
 var skills_default = app16;
 
 // packages/daemon/src/web/api/typing.ts
-import { zValidator as zValidator7 } from "@hono/zod-validator";
-import { Hono as Hono20 } from "hono";
-import { z as z7 } from "zod";
-var typingSchema = z7.object({
-  channel: z7.string().min(1),
-  sender: z7.string().min(1),
-  active: z7.boolean()
+import { zValidator as zValidator8 } from "@hono/zod-validator";
+import { Hono as Hono21 } from "hono";
+import { z as z8 } from "zod";
+var typingSchema = z8.object({
+  channel: z8.string().min(1),
+  sender: z8.string().min(1),
+  active: z8.boolean()
 });
-var app17 = new Hono20().post("/:name/typing", zValidator7("json", typingSchema), (c) => {
+var app17 = new Hono21().post("/:name/typing", zValidator8("json", typingSchema), (c) => {
   const { channel, sender, active } = c.req.valid("json");
   const map = getTypingMap();
   if (active) {
@@ -6645,9 +6822,9 @@ var typing_default = app17;
 
 // packages/daemon/src/web/api/update.ts
 import { spawn as spawn3 } from "child_process";
-import { Hono as Hono21 } from "hono";
+import { Hono as Hono22 } from "hono";
 var bin;
-var app18 = new Hono21().get("/update", async (c) => {
+var app18 = new Hono22().get("/update", async (c) => {
   const result = await checkForUpdate();
   return c.json(result);
 }).post("/update", requireAdmin, async (c) => {
@@ -6665,13 +6842,13 @@ var app18 = new Hono21().get("/update", async (c) => {
 var update_default = app18;
 
 // packages/daemon/src/web/api/v1/conversations.ts
-import { zValidator as zValidator8 } from "@hono/zod-validator";
-import { Hono as Hono22 } from "hono";
-import { z as z8 } from "zod";
-var createSchema = z8.object({
-  participantNames: z8.array(z8.string()).min(1)
+import { zValidator as zValidator9 } from "@hono/zod-validator";
+import { Hono as Hono23 } from "hono";
+import { z as z9 } from "zod";
+var createSchema = z9.object({
+  participantNames: z9.array(z9.string()).min(1)
 });
-var app19 = new Hono22().use("*", authMiddleware).get("/", async (c) => {
+var app19 = new Hono23().use("*", authMiddleware).get("/", async (c) => {
   const user = c.get("user");
   const convs = await listConversationsWithParticipants(user.id);
   return c.json(convs);
@@ -6698,7 +6875,7 @@ var app19 = new Hono22().use("*", authMiddleware).get("/", async (c) => {
   }
   const participants = await getParticipants(id);
   return c.json(participants);
-}).post("/", zValidator8("json", createSchema), async (c) => {
+}).post("/", zValidator9("json", createSchema), async (c) => {
   const user = c.get("user");
   const body = c.req.valid("json");
   const participantIds = /* @__PURE__ */ new Set();
@@ -6747,7 +6924,7 @@ var app19 = new Hono22().use("*", authMiddleware).get("/", async (c) => {
   }
   await markConversationRead(user.id, id);
   return c.json({ ok: true });
-}).put("/:id/private", zValidator8("json", z8.object({ private: z8.boolean() })), async (c) => {
+}).put("/:id/private", zValidator9("json", z9.object({ private: z9.boolean() })), async (c) => {
   const id = c.req.param("id");
   const user = c.get("user");
   if (!await isParticipantOrOwner(id, user.id)) {
@@ -6767,7 +6944,7 @@ var conversations_default = app19;
 
 // packages/daemon/src/web/api/v1/events.ts
 import { desc as desc5, eq as eq7 } from "drizzle-orm";
-import { Hono as Hono23 } from "hono";
+import { Hono as Hono24 } from "hono";
 import { streamSSE as streamSSE4 } from "hono/streaming";
 
 // packages/daemon/src/lib/events/brain-presence.ts
@@ -6830,7 +7007,7 @@ function getEventsSince(sinceId, allowedConversationIds, allowedActivityMind) {
 }
 
 // packages/daemon/src/web/api/v1/events.ts
-var app20 = new Hono23().use("*", authMiddleware).get("/", async (c) => {
+var app20 = new Hono24().use("*", authMiddleware).get("/", async (c) => {
   const user = c.get("user");
   const since = c.req.query("since");
   const sinceId = since ? Number(since) : 0;
@@ -6848,7 +7025,7 @@ var app20 = new Hono23().use("*", authMiddleware).get("/", async (c) => {
         conversations2 = await listConversationsWithParticipants(user.id);
         if (conversations2.length > 0) {
           const convIds = conversations2.map((c2) => c2.id);
-          const unreads = await getUnreadCounts(user.id, convIds);
+          const unreads = await getUnreadCounts(user.id, convIds, user.username);
           for (const conv of conversations2) {
             conv.unreadCount = unreads[conv.id] ?? 0;
           }
@@ -6924,8 +7101,8 @@ var app20 = new Hono23().use("*", authMiddleware).get("/", async (c) => {
         });
       }, 15e3);
       cleanups.push(() => clearInterval(keepAlive));
-      await new Promise((resolve18) => {
-        stream.onAbort(() => resolve18());
+      await new Promise((resolve17) => {
+        stream.onAbort(() => resolve17());
       });
     } finally {
       for (const cleanup of cleanups) {
@@ -6941,15 +7118,15 @@ var events_default = app20;
 
 // packages/daemon/src/web/api/variants.ts
 import { existsSync as existsSync9, mkdirSync as mkdirSync9, writeFileSync as writeFileSync8 } from "fs";
-import { resolve as resolve15 } from "path";
-import { Hono as Hono24 } from "hono";
+import { resolve as resolve14 } from "path";
+import { Hono as Hono25 } from "hono";
 
 // packages/daemon/src/lib/mind/spawn-server.ts
 import { spawn as spawn4 } from "child_process";
 import { closeSync, mkdirSync as mkdirSync8, openSync, readFileSync as readFileSync9 } from "fs";
-import { resolve as resolve14 } from "path";
+import { resolve as resolve13 } from "path";
 function tsxBin(cwd) {
-  return resolve14(cwd, "node_modules", ".bin", "tsx");
+  return resolve13(cwd, "node_modules", ".bin", "tsx");
 }
 async function spawnServer(cwd, port, options) {
   let cmd = tsxBin(cwd);
@@ -6971,31 +7148,31 @@ function spawnAttached(cmd, args, cwd) {
     cwd,
     stdio: ["ignore", "pipe", "pipe"]
   });
-  return new Promise((resolve18) => {
-    const timeout = setTimeout(() => resolve18(null), 3e4);
+  return new Promise((resolve17) => {
+    const timeout = setTimeout(() => resolve17(null), 3e4);
     function checkOutput(data) {
       const match = data.toString().match(/listening on :(\d+)/);
       if (match) {
         clearTimeout(timeout);
-        resolve18({ child, actualPort: parseInt(match[1], 10) });
+        resolve17({ child, actualPort: parseInt(match[1], 10) });
       }
     }
     child.stdout?.on("data", checkOutput);
     child.stderr?.on("data", checkOutput);
     child.on("error", () => {
       clearTimeout(timeout);
-      resolve18(null);
+      resolve17(null);
     });
     child.on("exit", () => {
       clearTimeout(timeout);
-      resolve18(null);
+      resolve17(null);
     });
   });
 }
 function spawnDetached(cmd, args, cwd, logDir) {
-  const logsDir = logDir ?? resolve14(cwd, ".mind", "logs");
+  const logsDir = logDir ?? resolve13(cwd, ".mind", "logs");
   mkdirSync8(logsDir, { recursive: true });
-  const logPath = resolve14(logsDir, "mind.log");
+  const logPath = resolve13(logsDir, "mind.log");
   const logFd = openSync(logPath, "a");
   const child = spawn4(cmd, args, {
     cwd,
@@ -7067,7 +7244,7 @@ async function verify2(port) {
 }
 
 // packages/daemon/src/web/api/variants.ts
-var app21 = new Hono24().get("/:name/variants", async (c) => {
+var app21 = new Hono25().get("/:name/variants", async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
@@ -7111,11 +7288,11 @@ var app21 = new Hono24().get("/:name/variants", async (c) => {
     return c.json({ error: `Name already in use: ${variantName}` }, 409);
   }
   const projectRoot = mindDir(mindName);
-  const variantDir = resolve15(projectRoot, ".variants", variantName);
+  const variantDir = resolve14(projectRoot, ".variants", variantName);
   if (existsSync9(variantDir)) {
     return c.json({ error: `Variant directory already exists: ${variantDir}` }, 409);
   }
-  mkdirSync9(resolve15(projectRoot, ".variants"), { recursive: true });
+  mkdirSync9(resolve14(projectRoot, ".variants"), { recursive: true });
   try {
     await gitExec(["worktree", "add", "-b", variantName, variantDir], { cwd: projectRoot });
   } catch (e) {
@@ -7128,7 +7305,7 @@ var app21 = new Hono24().get("/:name/variants", async (c) => {
       const [cmd, args] = await wrapForIsolation("npm", ["install"], mindName);
       await exec(cmd, args, {
         cwd: variantDir,
-        env: { ...process.env, HOME: resolve15(variantDir, "home") }
+        env: { ...process.env, HOME: resolve14(variantDir, "home") }
       });
     } else {
       await exec("npm", ["install"], { cwd: variantDir });
@@ -7138,13 +7315,15 @@ var app21 = new Hono24().get("/:name/variants", async (c) => {
     return c.json({ error: `npm install failed: ${msg}` }, 500);
   }
   if (body.soul) {
-    writeFileSync8(resolve15(variantDir, "home/SOUL.md"), body.soul);
+    writeFileSync8(resolve14(variantDir, "home/SOUL.md"), body.soul);
   }
   const variantPort = body.port ?? await nextPort();
   await addVariant(variantName, mindName, variantPort, variantDir, variantName);
   if (!body.noStart) {
     try {
-      await getMindManager().startMind(variantName);
+      const manager = getMindManager();
+      manager.setPendingContext(variantName, { type: "split", parent: mindName });
+      await manager.startMind(variantName);
     } catch (e) {
       const msg = e instanceof Error ? e.message : String(e);
       return c.json({ error: `Variant created but failed to start: ${msg}` }, 500);
@@ -7238,7 +7417,7 @@ var app21 = new Hono24().get("/:name/variants", async (c) => {
   if (variantName.endsWith("-upgrade") || variantName === "upgrade") {
     try {
       const { computeTemplateHash: computeTemplateHash2 } = await import("./template-hash-446HHH5V.js");
-      const { setMindTemplateHash: setMindTemplateHash2 } = await import("./registry-7LQHTRUX.js");
+      const { setMindTemplateHash: setMindTemplateHash2 } = await import("./registry-NUJAGLQJ.js");
       const tmpl = parentEntry.template ?? "claude";
       await setMindTemplateHash2(mindName, computeTemplateHash2(tmpl));
     } catch (err) {
@@ -7251,7 +7430,7 @@ var app21 = new Hono24().get("/:name/variants", async (c) => {
       const [cmd, args] = await wrapForIsolation("npm", ["install"], mindName);
       await exec(cmd, args, {
         cwd: projectRoot,
-        env: { ...process.env, HOME: resolve15(projectRoot, "home") }
+        env: { ...process.env, HOME: resolve14(projectRoot, "home") }
       });
     } else {
       await exec("npm", ["install"], { cwd: projectRoot });
@@ -7296,22 +7475,22 @@ var app21 = new Hono24().get("/:name/variants", async (c) => {
 var variants_default = app21;
 
 // packages/daemon/src/web/api/volute/channels.ts
-import { zValidator as zValidator9 } from "@hono/zod-validator";
-import { Hono as Hono25 } from "hono";
-import { z as z9 } from "zod";
-var channelSettingsSchema = z9.object({
-  description: z9.string().nullable().optional(),
-  rules: z9.string().nullable().optional(),
-  charLimit: z9.number().int().positive().nullable().optional(),
-  private: z9.boolean().optional()
+import { zValidator as zValidator10 } from "@hono/zod-validator";
+import { Hono as Hono26 } from "hono";
+import { z as z10 } from "zod";
+var channelSettingsSchema = z10.object({
+  description: z10.string().nullable().optional(),
+  rules: z10.string().nullable().optional(),
+  charLimit: z10.number().int().positive().nullable().optional(),
+  private: z10.boolean().optional()
 });
-var createSchema2 = z9.object({
-  name: z9.string().min(1).max(50).regex(/^[a-z0-9][a-z0-9-]*$/, "Channel names must be lowercase alphanumeric with hyphens")
+var createSchema2 = z10.object({
+  name: z10.string().min(1).max(50).regex(/^[a-z0-9][a-z0-9-]*$/, "Channel names must be lowercase alphanumeric with hyphens")
 }).merge(channelSettingsSchema);
-var inviteSchema = z9.object({
-  username: z9.string().min(1)
+var inviteSchema = z10.object({
+  username: z10.string().min(1)
 });
-var app22 = new Hono25().get("/", async (c) => {
+var app22 = new Hono26().get("/", async (c) => {
   const user = c.get("user");
   const channels2 = await listChannels();
   const results = await Promise.all(
@@ -7322,7 +7501,7 @@ var app22 = new Hono25().get("/", async (c) => {
     })
   );
   return c.json(results);
-}).post("/", zValidator9("json", createSchema2), async (c) => {
+}).post("/", zValidator10("json", createSchema2), async (c) => {
   const user = c.get("user");
   const body = c.req.valid("json");
   try {
@@ -7350,7 +7529,7 @@ var app22 = new Hono25().get("/", async (c) => {
     participants,
     settings: formatChannelSettings(settings)
   });
-}).patch("/:name", zValidator9("json", channelSettingsSchema), async (c) => {
+}).patch("/:name", zValidator10("json", channelSettingsSchema), async (c) => {
   const name = c.req.param("name");
   const user = c.get("user");
   const body = c.req.valid("json");
@@ -7382,7 +7561,7 @@ var app22 = new Hono25().get("/", async (c) => {
   if (!ch) return c.json({ error: "Channel not found" }, 404);
   const participants = await getParticipants(ch.id);
   return c.json(participants);
-}).post("/:name/invite", zValidator9("json", inviteSchema), async (c) => {
+}).post("/:name/invite", zValidator10("json", inviteSchema), async (c) => {
   const name = c.req.param("name");
   const inviter = c.get("user");
   const { username } = c.req.valid("json");
@@ -7408,27 +7587,27 @@ var app22 = new Hono25().get("/", async (c) => {
 var channels_default2 = app22;
 
 // packages/daemon/src/web/api/volute/chat.ts
-import { zValidator as zValidator10 } from "@hono/zod-validator";
-import { Hono as Hono26 } from "hono";
+import { zValidator as zValidator11 } from "@hono/zod-validator";
+import { Hono as Hono27 } from "hono";
 import { streamSSE as streamSSE5 } from "hono/streaming";
-import { z as z10 } from "zod";
-var fileSchema = z10.object({
-  filename: z10.string(),
-  data: z10.string()
+import { z as z11 } from "zod";
+var fileSchema = z11.object({
+  filename: z11.string(),
+  data: z11.string()
   // base64
 });
-var chatSchema = z10.object({
-  message: z10.string().optional(),
-  conversationId: z10.string().optional(),
-  targetMind: z10.string().optional(),
-  sender: z10.string().optional(),
-  images: z10.array(
-    z10.object({
-      media_type: z10.string(),
-      data: z10.string()
+var chatSchema = z11.object({
+  message: z11.string().optional(),
+  conversationId: z11.string().optional(),
+  targetMind: z11.string().optional(),
+  sender: z11.string().optional(),
+  images: z11.array(
+    z11.object({
+      media_type: z11.string(),
+      data: z11.string()
     })
   ).optional(),
-  files: z10.array(fileSchema).optional()
+  files: z11.array(fileSchema).optional()
 });
 var MAX_FILE_SIZE2 = 50 * 1024 * 1024;
 function stageFilesForMinds(files, targetMinds, senderName) {
@@ -7456,9 +7635,9 @@ function stageFilesForMinds(files, targetMinds, senderName) {
   }
   return { notifications };
 }
-var unifiedChatApp = new Hono26().post(
+var unifiedChatApp = new Hono27().post(
   "/chat",
-  zValidator10("json", chatSchema),
+  zValidator11("json", chatSchema),
   async (c) => {
     const user = c.get("user");
     const body = c.req.valid("json");
@@ -7579,6 +7758,19 @@ var unifiedChatApp = new Hono26().post(
       senderBase = await getBaseName(senderName);
       outboundTurnId = getActiveTurnId(senderBase, c.get("mindSession"));
     }
+    if (senderIsMind && senderBase) {
+      const gate = await checkStaleSend(senderBase, conversationId, [senderName, senderBase]);
+      if (gate.held && gate.unseen) {
+        const label = buildVoluteSlug({
+          participants,
+          mindUsername: senderName,
+          conversationId,
+          convType: conv.type,
+          convName
+        });
+        return c.json({ ok: true, held: true, notice: formatHoldNotice(label, gate.unseen) });
+      }
+    }
     const message = await addMessage(conversationId, "user", senderName, contentBlocks, {
       turnId: outboundTurnId
     });
@@ -7619,7 +7811,6 @@ var unifiedChatApp = new Hono26().post(
       conversationId,
       contentBlocks,
       senderName,
-      senderIsMind: !!senderIsMind,
       participants,
       isDM,
       slugExtra: { convType: conv.type, convName },
@@ -7638,7 +7829,7 @@ var unifiedChatApp = new Hono26().post(
     return c.json({ ok: true, conversationId, outboundId });
   }
 );
-var app23 = new Hono26().get("/:name/conversations/:id/events", async (c) => {
+var app23 = new Hono27().get("/:name/conversations/:id/events", async (c) => {
   const conversationId = c.req.param("id");
   const user = c.get("user");
   if (user.id !== 0 && !await isParticipantOrOwner(conversationId, user.id)) {
@@ -7655,11 +7846,11 @@ var app23 = new Hono26().get("/:name/conversations/:id/events", async (c) => {
         if (!stream.aborted) console.error("[chat] SSE ping error:", err);
       });
     }, 15e3);
-    await new Promise((resolve18) => {
+    await new Promise((resolve17) => {
       stream.onAbort(() => {
         unsubscribe();
         clearInterval(keepAlive);
-        resolve18();
+        resolve17();
       });
     });
   });
@@ -7667,14 +7858,14 @@ var app23 = new Hono26().get("/:name/conversations/:id/events", async (c) => {
 var chat_default = app23;
 
 // packages/daemon/src/web/api/volute/conversations.ts
-import { zValidator as zValidator11 } from "@hono/zod-validator";
-import { Hono as Hono27 } from "hono";
-import { z as z11 } from "zod";
-var createConvSchema = z11.object({
-  participantIds: z11.array(z11.number()).optional(),
-  participantNames: z11.array(z11.string()).optional()
+import { zValidator as zValidator12 } from "@hono/zod-validator";
+import { Hono as Hono28 } from "hono";
+import { z as z12 } from "zod";
+var createConvSchema = z12.object({
+  participantIds: z12.array(z12.number()).optional(),
+  participantNames: z12.array(z12.string()).optional()
 });
-var app24 = new Hono27().get("/:name/conversations", async (c) => {
+var app24 = new Hono28().get("/:name/conversations", async (c) => {
   const name = c.req.param("name");
   const user = c.get("user");
   let lookupId = user.id;
@@ -7684,7 +7875,7 @@ var app24 = new Hono27().get("/:name/conversations", async (c) => {
   }
   const convs = await listConversationsForUser(lookupId);
   return c.json(convs);
-}).post("/:name/conversations", zValidator11("json", createConvSchema), async (c) => {
+}).post("/:name/conversations", zValidator12("json", createConvSchema), async (c) => {
   const name = c.req.param("name");
   const user = c.get("user");
   const body = c.req.valid("json");
@@ -7780,7 +7971,7 @@ var conversations_default2 = app24;
 
 // packages/daemon/src/web/app.ts
 var httpLog = logger_default.child("http");
-var app25 = new Hono28();
+var app25 = new Hono29();
 app25.onError((err, c) => {
   if (err instanceof HTTPException) {
     return err.getResponse();
@@ -7847,10 +8038,11 @@ app25.use("/api/skills/*", authMiddleware);
 app25.use("/api/extensions/*", authMiddleware);
 app25.use("/api/bridges/*", authMiddleware);
 app25.use("/api/config/*", authMiddleware);
+app25.use("/api/backup/*", authMiddleware);
 app25.use("/api/v1/*", authMiddleware);
 app25.route("/api/setup", setup_default);
 app25.route("/api/config", config_default);
-var routes = app25.route("/api/activity", activity_default).route("/api/keys", keys_default).route("/api/auth", auth_default).route("/api/system", system_default).route("/api/system", update_default).route("/api/minds", minds_default).route("/api/minds", chat_default).route("/api/minds", schedules_default).route("/api/minds", logs_default).route("/api/minds", typing_default).route("/api/minds", variants_default).route("/api/minds", file_sharing_default).route("/api/minds", files_default).route("/api/minds", channels_default).route("/api/minds", env_default).route("/api/minds", mind_skills_default).route("/api/minds", conversations_default2).route("/api/env", sharedEnvApp).route("/api/prompts", prompts_default).route("/api/skills", skills_default).route("/api/bridges", bridges_default).route("/api/extensions", extensions_default).route("/api/v1/conversations", conversations_default).route("/api/v1/events", events_default).route("/api/v1", unifiedChatApp).route("/api/v1/channels", channels_default2).route("/api/v1/history", history_default);
+var routes = app25.route("/api/activity", activity_default).route("/api/keys", keys_default).route("/api/auth", auth_default).route("/api/system", system_default).route("/api/system", update_default).route("/api/backup", backup_default).route("/api/minds", minds_default).route("/api/minds", chat_default).route("/api/minds", schedules_default).route("/api/minds", logs_default).route("/api/minds", typing_default).route("/api/minds", variants_default).route("/api/minds", file_sharing_default).route("/api/minds", files_default).route("/api/minds", channels_default).route("/api/minds", env_default).route("/api/minds", mind_skills_default).route("/api/minds", conversations_default2).route("/api/env", sharedEnvApp).route("/api/prompts", prompts_default).route("/api/skills", skills_default).route("/api/bridges", bridges_default).route("/api/extensions", extensions_default).route("/api/v1/conversations", conversations_default).route("/api/v1/events", events_default).route("/api/v1", unifiedChatApp).route("/api/v1/channels", channels_default2).route("/api/v1/history", history_default);
 app25.route("/api/v1/minds", minds_default);
 app25.route("/api/v1/minds", chat_default);
 app25.route("/api/v1/minds", typing_default);
@@ -7872,7 +8064,7 @@ var app_default = app25;
 import { existsSync as existsSync10 } from "fs";
 import { readFile as readFile2, stat as stat2 } from "fs/promises";
 import { createServer as createHttpsServer } from "https";
-import { dirname as dirname2, extname as extname3, resolve as resolve16 } from "path";
+import { dirname as dirname2, extname as extname3, resolve as resolve15 } from "path";
 import { serve } from "@hono/node-server";
 var MIME_TYPES2 = {
   ".html": "text/html",
@@ -7891,7 +8083,7 @@ async function startServer({
   let assetsDir = "";
   let searchDir = dirname2(new URL(import.meta.url).pathname);
   for (let i = 0; i < 5; i++) {
-    const candidate = resolve16(searchDir, "dist", "web-assets");
+    const candidate = resolve15(searchDir, "dist", "web-assets");
     if (existsSync10(candidate)) {
       assetsDir = candidate;
       break;
@@ -7902,20 +8094,20 @@ async function startServer({
     app_default.get("*", async (c) => {
       const urlPath = new URL(c.req.url).pathname;
       if (urlPath.startsWith("/api/") || urlPath.startsWith("/ext/")) return c.notFound();
-      const filePath = resolve16(assetsDir, urlPath.slice(1));
+      const filePath = resolve15(assetsDir, urlPath.slice(1));
       if (!filePath.startsWith(assetsDir)) return c.text("Forbidden", 403);
       const s = await stat2(filePath).catch(() => null);
       if (s?.isFile()) {
         const ext = extname3(filePath);
         const mime = MIME_TYPES2[ext] || "application/octet-stream";
         const body = await readFile2(filePath);
-        const basename2 = filePath.slice(filePath.lastIndexOf("/") + 1);
-        const nameWithoutExt = basename2.slice(0, basename2.lastIndexOf("."));
+        const basename = filePath.slice(filePath.lastIndexOf("/") + 1);
+        const nameWithoutExt = basename.slice(0, basename.lastIndexOf("."));
         const isHashed = /[-.][\da-f]{8,}$/.test(nameWithoutExt);
         const cacheControl = isHashed ? "public, max-age=31536000, immutable" : "no-cache";
         return c.body(body, 200, { "Content-Type": mime, "Cache-Control": cacheControl });
       }
-      const indexPath = resolve16(assetsDir, "index.html");
+      const indexPath = resolve15(assetsDir, "index.html");
       const indexStat = await stat2(indexPath).catch(() => null);
       if (indexStat?.isFile()) {
         const body = await readFile2(indexPath, "utf-8");
@@ -7932,10 +8124,10 @@ async function startServer({
       createServer: createHttpsServer,
       serverOptions: { key: tls.key, cert: tls.cert }
     });
-    await new Promise((resolve18, reject) => {
+    await new Promise((resolve17, reject) => {
       server2.on("listening", () => {
         logger_default.info("Volute UI running (https)", { hostname, port });
-        resolve18();
+        resolve17();
       });
       server2.on("error", (err) => {
         reject(err);
@@ -7943,13 +8135,13 @@ async function startServer({
     });
     const internalPort = port + 1;
     const internalServer = serve({ fetch: app_default.fetch, port: internalPort, hostname: "127.0.0.1" });
-    await new Promise((resolve18, reject) => {
+    await new Promise((resolve17, reject) => {
       internalServer.on("listening", () => {
         logger_default.info("Volute API running (http, internal)", {
           hostname: "127.0.0.1",
           port: internalPort
         });
-        resolve18();
+        resolve17();
       });
       internalServer.on("error", (err) => {
         reject(err);
@@ -7958,10 +8150,10 @@ async function startServer({
     return { server: server2, internalPort };
   }
   const server = serve({ fetch: app_default.fetch, port, hostname });
-  await new Promise((resolve18, reject) => {
+  await new Promise((resolve17, reject) => {
     server.on("listening", () => {
       logger_default.info("Volute API running (http)", { hostname, port });
-      resolve18();
+      resolve17();
     });
     server.on("error", (err) => {
       reject(err);
@@ -7972,17 +8164,17 @@ async function startServer({
 
 // packages/daemon/src/daemon.ts
 if (!process.env.VOLUTE_HOME) {
-  process.env.VOLUTE_HOME = resolve17(homedir3(), ".volute");
+  process.env.VOLUTE_HOME = resolve16(homedir3(), ".volute");
 }
 if (process.env.VOLUTE_TIMEZONE && !process.env.TZ) {
   process.env.TZ = process.env.VOLUTE_TIMEZONE;
 }
 function writeDaemonConfig(systemDir, config2, token) {
-  const configPath = resolve17(systemDir, "daemon.json");
+  const configPath = resolve16(systemDir, "daemon.json");
   writeFileSync9(configPath, `${JSON.stringify(config2, null, 2)}
 `, { mode: 420 });
   chmodSync(configPath, 420);
-  const tokenPath = resolve17(systemDir, "daemon-token");
+  const tokenPath = resolve16(systemDir, "daemon-token");
   writeFileSync9(tokenPath, `${token}
 `, { mode: 384 });
   chmodSync(tokenPath, 384);
@@ -7993,7 +8185,7 @@ async function startDaemon(opts) {
   const home = voluteHome();
   const systemDir = voluteSystemDir();
   if (!opts.foreground) {
-    const rotatingLog = new RotatingLog(resolve17(systemDir, "daemon.log"));
+    const rotatingLog = new RotatingLog(resolve16(systemDir, "daemon.log"));
     logger_default.setOutput((line) => rotatingLog.write(`${line}
 `));
     const write = (...args) => rotatingLog.write(`${format(...args)}
@@ -8003,26 +8195,32 @@ async function startDaemon(opts) {
     console.warn = write;
     console.info = write;
   }
-  const DAEMON_PID_PATH = resolve17(systemDir, "daemon.pid");
-  const DAEMON_JSON_PATH = resolve17(systemDir, "daemon.json");
-  const DAEMON_TOKEN_PATH = resolve17(systemDir, "daemon-token");
+  const DAEMON_PID_PATH = resolve16(systemDir, "daemon.pid");
+  const DAEMON_JSON_PATH = resolve16(systemDir, "daemon.json");
+  const DAEMON_TOKEN_PATH = resolve16(systemDir, "daemon-token");
   mkdirSync10(home, { recursive: true });
   ensureSystemDir();
-  const { migrateConfigSecrets, migrateSetupCompleted } = await import("./setup-25MMJ3J4.js");
+  const { migrateConfigSecrets, migrateSetupCompleted } = await import("./setup-73YBJZQL.js");
   migrateConfigSecrets();
   migrateSetupCompleted();
-  const { migrateAiModelQualification } = await import("./ai-service-FBCCEYF5.js");
+  const { migrateAiModelQualification } = await import("./ai-service-534WUSDL.js");
   migrateAiModelQualification();
-  await (await import("./db-CZV62BOQ.js")).getDb();
+  await (await import("./db-JFLCJCUG.js")).getDb();
   try {
     const { eq: eq8, and: and6 } = await import("drizzle-orm");
-    const { users: users2 } = await import("./schema-LRUTFOER.js");
-    const db = await (await import("./db-CZV62BOQ.js")).getDb();
+    const { users: users2 } = await import("./schema-PVNG3PQM.js");
+    const db = await (await import("./db-JFLCJCUG.js")).getDb();
     await db.update(users2).set({ role: "system" }).where(and6(eq8(users2.user_type, "system"), eq8(users2.role, "user")));
   } catch (err) {
     logger_default.warn("failed to migrate system user role", logger_default.errorData(err));
   }
-  const { initSandbox } = await import("./sandbox-SJH3XOPZ.js");
+  try {
+    const { migrateAvatarSizes } = await import("./avatar-image-BNWEXSA2.js");
+    await migrateAvatarSizes();
+  } catch (err) {
+    logger_default.warn("avatar size migration failed", logger_default.errorData(err));
+  }
+  const { initSandbox } = await import("./sandbox-72MWV4JL.js");
   await initSandbox();
   try {
     await syncBuiltinSkills();
@@ -8049,7 +8247,7 @@ async function startDaemon(opts) {
     logger_default.warn("failed to ensure #system channel", logger_default.errorData(err));
   }
   try {
-    const { getOrCreateSystemUser: getOrCreateSystemUser2 } = await import("./auth-3RIG6GKN.js");
+    const { getOrCreateSystemUser: getOrCreateSystemUser2 } = await import("./auth-FRZJVQCS.js");
     await getOrCreateSystemUser2();
   } catch (err) {
     logger_default.warn(
@@ -8057,13 +8255,13 @@ async function startDaemon(opts) {
       logger_default.errorData(err)
     );
   }
-  const token = process.env.VOLUTE_DAEMON_TOKEN || randomBytes2(32).toString("hex");
-  const { readGlobalConfig: readGlobalConfig2 } = await import("./setup-25MMJ3J4.js");
+  const token = process.env.VOLUTE_DAEMON_TOKEN || randomBytes3(32).toString("hex");
+  const { readGlobalConfig: readGlobalConfig2 } = await import("./setup-73YBJZQL.js");
   const globalCfg = readGlobalConfig2();
   let tls;
   if (opts.tailscale || globalCfg.tailscale) {
     try {
-      const { getTailscaleTls } = await import("./tailscale-Q7ZJL7S7.js");
+      const { getTailscaleTls } = await import("./tailscale-QAWVKQKU.js");
       const tlsConfig = await getTailscaleTls();
       tls = { key: tlsConfig.key, cert: tlsConfig.cert };
       logger_default.info("Tailscale HTTPS enabled", { hostname: tlsConfig.hostname });
@@ -8109,6 +8307,8 @@ async function startDaemon(opts) {
   sleepManager.start();
   const summarizer = initSummarizer();
   summarizer.start();
+  const backupManager2 = initBackupManager();
+  backupManager2.start();
   const unsubscribeWebhook = initWebhook();
   const orphanedTurns = await completeOrphanedTurns();
   summarizeOrphanedTurns(orphanedTurns);
@@ -8141,10 +8341,10 @@ async function startDaemon(opts) {
     await Promise.all(workers);
   }
   try {
-    const { isSetupComplete: isSetupComplete2 } = await import("./setup-25MMJ3J4.js");
+    const { isSetupComplete: isSetupComplete2 } = await import("./setup-73YBJZQL.js");
     if (isSetupComplete2()) {
-      const { ensureSpiritProject, syncSpiritTemplate } = await import("./spirit-53DQPRNR.js");
-      const { startSpiritFull } = await import("./mind-service-2C7AINBO.js");
+      const { ensureSpiritProject, syncSpiritTemplate } = await import("./spirit-II3HOERM.js");
+      const { startSpiritFull } = await import("./mind-service-BF2LUQMH.js");
       await ensureSpiritProject();
       await syncSpiritTemplate();
       const spiritEntry = await findMind("volute");
@@ -8161,7 +8361,7 @@ async function startDaemon(opts) {
   bridgeManager.startBridges(daemonPort).catch((err) => {
     logger_default.warn("failed to start bridges", logger_default.errorData(err));
   });
-  import("./cloud-sync-KOEBUFW5.js").then(
+  import("./cloud-sync-Y7LQPRE3.js").then(
     ({ consumeQueuedMessages }) => consumeQueuedMessages().catch((err) => {
       logger_default.warn("failed to consume queued cloud messages", logger_default.errorData(err));
     })
@@ -8169,7 +8369,7 @@ async function startDaemon(opts) {
     logger_default.warn("failed to load cloud-sync module", logger_default.errorData(err));
   });
   try {
-    const { backfillTemplateHashes, notifyVersionUpdate } = await import("./version-notify-SRQJCQEK.js");
+    const { backfillTemplateHashes, notifyVersionUpdate } = await import("./version-notify-CODJOUW2.js");
     backfillTemplateHashes();
     notifyVersionUpdate().catch((err) => {
       logger_default.warn("failed to send version update notifications", logger_default.errorData(err));
@@ -8237,6 +8437,7 @@ async function startDaemon(opts) {
       safe("mailPoller.stop", () => mailPoller.stop());
       safe("tokenBudget.stop", () => tokenBudget.stop());
       safe("summarizer.stop", () => summarizer.stop());
+      safe("backupManager.stop", () => backupManager2.stop());
       safe("stopApiKeyRefresh", stopApiKeyRefresh);
       safe("delivery.dispose", () => delivery.dispose());
       await safe("bridgeManager.stopAll", () => bridgeManager.stopAll());